Extracted

• • Target

    0874e9314287bead42831de42f491e79_JaffaCakes118

  • Size

    534KB

  • MD5

    0874e9314287bead42831de42f491e79

  • SHA1

    2015d5ed50a5fa266338cfcdfcf14003e29caff6

  • SHA256

    7496aa45727b1e0fe4094b9397f5b0365ac64424cc03bd5c82e35489d5c2da33

  • SHA512

    e1255e38d7f511a28e27ed8bbf46ea5c22640963ea106bb1e91747f6ac76a36e06d3c2499b54eb74789e1ae3cd3260acf0bca5e673240d2e80d2b2c5ff071e8f

  • SSDEEP

    12288:26lt/9TaMFyIspMSOtRNzWchOBP9B6k8zuSV9MM7:7wySSd4B

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2