Extracted

• • Target

    ebb0766d2b3da782f018f85f0cefd464_JaffaCakes118

  • Size

    327KB

  • MD5

    ebb0766d2b3da782f018f85f0cefd464

  • SHA1

    31b2ce8894efb958794dddb1d9843cc76c2a24eb

  • SHA256

    258f9b15dcf9b9be2b491ea56faf0e971e2086d536a6955b5c4fdc1450bec17e

  • SHA512

    7aeb5a214cdde29bd586249b56737ecf51ac407cc64471a49905f296f3bb0a4421787f1bdcf5e17505a46a0870ad247e51a47434769a391abd7fa670d4bd7907

  • SSDEEP

    6144:YtCwERQ+3HwO3j3K5u3SvkLtYA4SDOFOsa6yNuSVhQ5lJIsYmx70:cESo3zK5uPtB4S8oT2GmY

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2