Extracted

• • Target

    92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118

  • Size

    321KB

  • MD5

    92f621fe4834e0ba3bc3b0038bff3b8d

  • SHA1

    7fec5da55e92dae36a0aa8310c5a223b2dbab9bb

  • SHA256

    7f8005263bd0f294e941bcb91055b8be6c4d55266ca6e37f5c146ca2e3362a9f

  • SHA512

    0b5592d019bd019e0026a6741086aa72b82238294034f649769f8f2adaa870b3da8f337331bffc61f350b76e811218b82a6c71a637227904d8fec94eced1e22d

  • SSDEEP

    6144:Qb8ZCMkhBDmysZHCJGLIHvdOCO65oKW8x2IV0YhUqSakpOGiRx:ZfSBnsN/SdaH702IVbrSak+x

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2