Extracted

• • Target

    f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118

  • Size

    994KB

  • MD5

    f5f6f3f20d2279fbcfe3459c2f506996

  • SHA1

    af053d5263eaf3260eabb37822361c1017a18306

  • SHA256

    0497fc206987e992f615638411ea9da0470e2dcbcd05546d4240ef09a82f925f

  • SHA512

    a88fae8375449bf448148098b95d98df598cc0985ee9c6bfb6ab585d1e85c7d91cffbd1c8c6504832da8b82042726d6c3a9d7a3a1bc09b96618bd0e810fdb23c

  • SSDEEP

    24576:STbtwEMGXU0oS1uhX+mOPEXPbc2b95QOz3:SHpMuTut7TXb95H3

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2