Extracted

• • Target

    e9560a8852fb5058cc88dcbb6a14796c_JaffaCakes118

  • Size

    817KB

  • MD5

    e9560a8852fb5058cc88dcbb6a14796c

  • SHA1

    2cfb727eb366e2c9e5a896d63ccff51f145a25f4

  • SHA256

    09ece919a018952bf923e290fbe576be1ecc78db1fd50c998bbd785219c6aea5

  • SHA512

    385dae8be436ada3ee3506aeb6e377c874496f8cab710d3371383965db93db8d7adf4a0b63344495edf5bcb41a5e7bb796ec72797b274fef7f482ca699e107d7

  • SSDEEP

    12288:hQJZN2sCDO4+yGJPt72RbNUJ9NzfhCAbuYjQ9NyW+tGmvB1P6Dj0bo9u4:WJZN2PDO4+ygCLS9NVbu93rmQj0biu

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2