Extracted

• • Target

    83c11e7d4fcf13515fc5be9938dd75be_JaffaCakes118

  • Size

    641KB

  • MD5

    83c11e7d4fcf13515fc5be9938dd75be

  • SHA1

    5b1267583abf7803a20aa63bc9739894ee567c31

  • SHA256

    df9ce9ef0fe2c633c368b9859f6f88672b5be6867c52ad54d6b7ab42081893fd

  • SHA512

    6b07e7e369554e6bbe036263ef93fe2019606d8ac68049bc44b03dbcaccc5e4f47975fc59d5d54a9fde6bfced9e51f44340de1c8bc3e92f6cbbf84c99fb5f2b2

  • SSDEEP

    12288:Yezd3qC2zcJ0DrpE5zSHPWEuB+wNaSctMX:YeRahzZpozSHPWEuBWM

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2