Extracted

• • Target

    f25f629de8fdb4ef25a1e95086c9d9b7_JaffaCakes118

  • Size

    782KB

  • MD5

    f25f629de8fdb4ef25a1e95086c9d9b7

  • SHA1

    ccbde1ec4060fd439495c6b446e68bcde4d748bf

  • SHA256

    0f817ba75c359bfe49dacc2f7c03162282e75b8cc955dc94abaebe5099489367

  • SHA512

    6bfa0b3dab28c4344575287370f08adb68972270137598384556bbee44ee9bc9545b97a23038d7f02fc1546383aee046bbe85ef77e8cc2ee1a21023e138e59d2

  • SSDEEP

    24576:fsMHAb0wFVMNj9b7CJtS+/T8sL6Wv0J8fXhzF2SYz:bAYwFShB8b1Lxv0JyT2SYz

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2