Extracted

• • Target

    0870fd6017b77dd109d498c4ef43b423_JaffaCakes118

  • Size

    664KB

  • MD5

    0870fd6017b77dd109d498c4ef43b423

  • SHA1

    d4fa08c2063deff83e5c3673a8dbc82226f30432

  • SHA256

    eb7e1d22eeb2b0c9e6dd88d64791d07414efd3eab95ff3bf1774efef8efb5712

  • SHA512

    5af90eee7ae5a5b3488379adc1e102114a7bac8f3fdec03edd7b3f20ba014eb84d875bb7c549ec432d52f6bc0d8319b3819dfa6fc6f04abcfaf5d6c344e727b6

  • SSDEEP

    12288:N1cTJ4240Bby1Li+TuBd3X3uIIIkIxV0DT:4S29by1Li+aBd3X3B+

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2