Extracted

• • Target

    402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118

  • Size

    420KB

  • MD5

    402d79de727a45d2a6977aeccddc5ea5

  • SHA1

    ae4f9ba1f308443e2f96d983d62cff66124efefd

  • SHA256

    3d6722b9d2cc8214cb14a6901f08821594e4da646eefc822e9015a7c8056fe91

  • SHA512

    fdb9483d58bce2671a80507bcd3919cf76704ba6871661432e7e92dfd5b374c5d0225c14275eba539276b61cfc086f234e26b77df5ae2127ed1b2add206d64ec

  • SSDEEP

    12288:z6A/Q6KbxBgxBi36bXQPiTbdrdR6DCpCr:z6sQ62426

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2