Extracted

• • Target

    cef5cc0360ad9c24ff1a9e1eb0e0bb2a_JaffaCakes118

  • Size

    587KB

  • MD5

    cef5cc0360ad9c24ff1a9e1eb0e0bb2a

  • SHA1

    c49443c6dff0cd84cf498443f2f24ba4fee65b16

  • SHA256

    d5a74e7489e757d5aa5340220d85e43ff4d620803dc212ed0b5029ae00311acf

  • SHA512

    cc1f49e7de5254bfb734c853bc1e2ea9c26005c25ed5ee720e57c56e8acb54e38c7a25a5df1c12d401f90ce851a1143e9f93548bcd60734f7b9266d5148f8f2d

  • SSDEEP

    12288:NkMMjQ7fwOsZfz6uvSgpGyadubRzoKZh:NeQrrsZfzdSUGISmh

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2