Extracted

• • Target

    0b41bfe23d015d2c114f2bae851d8528_JaffaCakes118

  • Size

    952KB

  • MD5

    0b41bfe23d015d2c114f2bae851d8528

  • SHA1

    e6b2f01a928e27c5c83b6290b2f39660f45ea130

  • SHA256

    3c76d24c83b79cb7426712fd591db33498e37a4ebbe109f300c6afb5c797e8b7

  • SHA512

    d9254ecc92125d5b88863e5685280eaf6141f119b422b7b5acb5e682163c5d3ab84c84471b711e3ba19b6d6bd25b8ada24f2c204f44843c116c418b3f1e8dc53

  • SSDEEP

    12288:zHu0Rx+i82Jxiw4jPCVSRVCgNYC4YyFczHk8kxuujl:zOOJx/4jxRQgNYC4BFczHk8kxdl

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2