Extracted

• • Target

    d0df47494727bcb81d5c01334f0a2132_JaffaCakes118

  • Size

    591KB

  • MD5

    d0df47494727bcb81d5c01334f0a2132

  • SHA1

    a4407c318b5cf507869ebbfebc1b68359cc176f5

  • SHA256

    1e82b02f7cc7ca0f1f879e7c352ab8d60e2fa81fde99cb650bf83a0c244e97d7

  • SHA512

    340b9a0ccf34e18da311bf804faa2e2a0b8ab93e4b1074b109652a99b2bd5ffb25d69739ad99aaf5622c944375d454a7e1e70ff0adcf686413d3d8d22d16883b

  • SSDEEP

    12288:KptAg/b2+nGUDp5a1uI8o8do9C30mFZyQG8J:sb2+GUDp5a5SZJFZD

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2