Extracted

• • Target

    c2ebf7eb257f86754ed67cbe47df9c4f_JaffaCakes118

  • Size

    489KB

  • MD5

    c2ebf7eb257f86754ed67cbe47df9c4f

  • SHA1

    adb2678b6166f5b6d6c1fe1db9d8db7442f62051

  • SHA256

    3fe0275748a53c76feb7146d57815397da2d3479562b21932d7f68b6cfe10dbd

  • SHA512

    c4fd2a513d0ee969c3bfe6031ae3e1f0febb2a5b41e9d7ea48ccee7ee1631890a888e806b4d6f572629302a4c82e3801ead0c0053bf4746e3c7b6ac15028a860

  • SSDEEP

    12288:rXi5LqWn/l9Lb9NzAbWDGlJkiqYh+qKSBb:O579NzwW6lJkiDhFB

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2