Extracted

• • Target

    JaffaCakes118_0a5d834587ed9c39cbd9e05b5db46df8

  • Size

    2.2MB

  • MD5

    0a5d834587ed9c39cbd9e05b5db46df8

  • SHA1

    a2f17d9474decfefdbba23b31dfc47dd662bb265

  • SHA256

    d33e00381cdafc0c33431016e4781e12e7d335e83ba405ae242ed54044af98d2

  • SHA512

    376866e27e8244c6630576294ad3a8edee53bdf30f210f46011f5cfc599db2c4853c523b0e792f17a1f1ad2021066f875c67d9a5b0e61d25a95a0d1e09c8df5b

  • SSDEEP

    12288:gOt1G044leEK+3ExXvA8fR5mPVr7iG2eXNPnrEdrE:SLhEK0q/A8fR5mPVr7iGxXN/odo

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2