Extracted

• • Target

    04eacebdb55557a3ebef76c5ef9b68c1_JaffaCakes118

  • Size

    755KB

  • MD5

    04eacebdb55557a3ebef76c5ef9b68c1

  • SHA1

    72f545b388e79c47205c5dadbfad45f7096e972f

  • SHA256

    118c359597e28e97538cdfc872032e8879955ec1168dffadd7a04bc8f703732f

  • SHA512

    fd7431977d5c049db768f6e833b92ebe230ec72d7aa8ebb88c58f6f608c48910f5ff4f3b55fd7fe4f235d52107a759cf21ecc8ff0850f4f8e6f0e5c56cbdc82d

  • SSDEEP

    12288:WnYomyPVVsJGZ7ol0e/x677QYiRfU4ZdcazeWE2yWMFpb/96vWJg6HRjvcguSvNz:WncyPVVsuol0eYqe4Xc2Il96eg6HRjvJ

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2