Extracted

• • Target

    f014241e8c93d4dbafb85339eae88015_JaffaCakes118

  • Size

    582KB

  • MD5

    f014241e8c93d4dbafb85339eae88015

  • SHA1

    9c5599c4f75b03928576778ec87a55d56d3cefde

  • SHA256

    b0cc2b05abaf593a784bb9d83cd0a61bf5b218605f61dba802df21c8ea54c7c6

  • SHA512

    117e90944b92a26a019aca33c2666d6beaa6a92ec237dc487c5a037ac309eb38cb15bfa4f801795d1bbef05b99ec494945a4e86c6e21a11bbff1ebaa7c746fc2

  • SSDEEP

    12288:0JLLLrNfcdb6I8LBqzdhRv8rjGiLnM0w+aa59oeGHcm7mo5oFCEkv:wNf0gtqZcj9/wR7mo5oFCEkv

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2