Extracted

• • Target

    51ef208ea36f798fe8c4f4a88bfcba5c_JaffaCakes118

  • Size

    641KB

  • MD5

    51ef208ea36f798fe8c4f4a88bfcba5c

  • SHA1

    5ea0c14f4eedeb9a76334c0ef6b1b8854b7c32b7

  • SHA256

    a82999d77adbff10ef701a595d165547fb73bf055dcae9b65d261e4d09c47654

  • SHA512

    6df28135bffb0fc54e3e45e97352d9177f1d1307f7e384ebe350c3d330c83c6461ba0b974010e92555ff6210bb271ee0d7788f69ea06148eead4398c0a5efb3f

  • SSDEEP

    12288:NcDxJRZCGoIOPZYNNjXW/K3YskewNaSctMX:NclrqIOPSNNTW/K3Ysk2M

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2