Extracted

• • Target

    d888198eb60c6c80d039ae12adb1e86f_JaffaCakes118

  • Size

    642KB

  • MD5

    d888198eb60c6c80d039ae12adb1e86f

  • SHA1

    55b3384a883b9ffc06bb531f78e8a399444ebc99

  • SHA256

    e1a998ebde58e307397c9446947fe0b10dee23f730388734331388b1184029cd

  • SHA512

    7bdb558c094e23129a6a2b79d36d67ad0de674278dbf21f2adc985d561c973f8fffdf9ea16df6a71494402e0523c5457f9a06b83114e0b9ab3264e93751f0032

  • SSDEEP

    12288:KhvPUi0BJgw5ZAGxTCw30VRH4jyjZGu1ahokB9:CHUiKNxTCw3gRUHoGB

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2