Extracted

• • Target

    0180553c8dd0975008452f800538d8f7_JaffaCakes118

  • Size

    775KB

  • MD5

    0180553c8dd0975008452f800538d8f7

  • SHA1

    1b8adfcb5619761bc44f6c17dde5477241bbf307

  • SHA256

    3db7acda49978813a627559815f7ed9af54b7eb1a914ad41ed3bddcdc96ebbb6

  • SHA512

    7a7438a51299e2cb7a91dee50effb40aca99b3ac719e05a375d5b846f59bd2f854aa7155a0036d412377e4acd2000280e23d4fd721d636a2d70b4bcfe65afec7

  • SSDEEP

    12288:wWJ/HK7zSCPuaj5cBcn/YP6r56B71riNHFwZ3Pe6/nD0lmkFN9xsGHf/cXnatxLt:wWgOCfqBM//d6l1riNv64VNT

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2