Extracted

• • Target

    d2d8e8905d69011b34b177964e22c8e2_JaffaCakes118

  • Size

    865KB

  • MD5

    d2d8e8905d69011b34b177964e22c8e2

  • SHA1

    27b627a50d34b9639d6bb26820b32e6456a820c1

  • SHA256

    5f8726a70210acce4b0c90d578efa854799a5bf7bceb8d2fb10854b83f2f0db3

  • SHA512

    61772143a06e8995fc1fbc67100f66438c32c6a0761f81a12436d9b7162480454ea907a90a8ca9253aa5992e59e5af0d5cafd6930ac3934b2a4c58f508401675

  • SSDEEP

    12288:4xApTtMHOtc7BwmNCyBfssh3rBNgprFVMi2vgmreIHK7z7zKboASYF:OApTrtcNd4MfVFiB92hKvzKbog

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2