General
-
Target
3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118
-
Size
532KB
-
Sample
240330-qvg4magc68
-
MD5
3cfe56e2909d9f61a0c4c2445c6f009a
-
SHA1
966650bdb4960b649aa7aaf3e3f9cbe80dc88321
-
SHA256
2ea1b409e3d1ad15c00c530f2b8e80ab58b116fe259b70882df8613a1cba9ca1
-
SHA512
b94b673fd340e9557479d05475a175881cddac4a1a7f03e285f76d93e2b7a44b3d4d6b5a51c4b8ccaf4aa683052ee623a0891faf0c35c195b7de054406e3e8bd
-
SSDEEP
12288:yzU1rExJeAkH8+/S8zNrRSBZQpFBm4gNvV:yzU1rExoQ8S8RABZeml
Static task
static1
Behavioral task
behavioral1
Sample
3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.venusosgb.com - Port:
587 - Username:
[email protected] - Password:
SX}5FZT_Lkmz - Email To:
[email protected]
Targets
-
-
Target
3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118
-
Size
532KB
-
MD5
3cfe56e2909d9f61a0c4c2445c6f009a
-
SHA1
966650bdb4960b649aa7aaf3e3f9cbe80dc88321
-
SHA256
2ea1b409e3d1ad15c00c530f2b8e80ab58b116fe259b70882df8613a1cba9ca1
-
SHA512
b94b673fd340e9557479d05475a175881cddac4a1a7f03e285f76d93e2b7a44b3d4d6b5a51c4b8ccaf4aa683052ee623a0891faf0c35c195b7de054406e3e8bd
-
SSDEEP
12288:yzU1rExJeAkH8+/S8zNrRSBZQpFBm4gNvV:yzU1rExoQ8S8RABZeml
Score10/10-
Snake Keylogger payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-