Extracted

• • Target

    ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118

  • Size

    767KB

  • MD5

    ecac725ddcdd32bc821da7f6857dec95

  • SHA1

    079fa74915e6fba3c13a510d2003e4119c724ac2

  • SHA256

    ce1cf72e73bce44e190b5998072b7069653c9afb3fe4499441e8d4d791f56837

  • SHA512

    ffa4a7994691f61571d645cefe8db66c896bdfa3b88db593ce0b6ecebad89b7c9d4245287a5a17a951429a1cf6944c3ffd36f655f2043fdbe1ddab3eba051a7f

  • SSDEEP

    12288:TzYXTjASHq0pkzV386oGr7m5WgaBEjvCov9hFcR64V7D3NLirTXFi4t2NjFA:TzOTcI486rriZaCLCE9wR9V7D3Nun84F

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2