Extracted

• • Target

    JaffaCakes118_478be5314f4b786f9ec75b2f86505743

  • Size

    461KB

  • MD5

    478be5314f4b786f9ec75b2f86505743

  • SHA1

    bb53424b79bdab45985441072ccf65a9f999b4d0

  • SHA256

    4995d93769866b4ac6e5f3b549ce0406f8fe2cc7e1c8724d3130193da6723c62

  • SHA512

    37793b7ec135e629378e8091acea6a26623f8c46e17bddb37bf3e05d58f289a683ee45bc782698268851586bdf10d040bd9e4aae84f2fe1067a6251f2a11abd1

  • SSDEEP

    6144:WGxhLzI5Pv0C1VG51XsFtxF+onRfO3txTA+PXwQ08Rbs79RpzcALh:/sJXV0XsXxFBRfIAuAQ08cXpFL

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2