Extracted

• • Target

    14760af468d576c8d907305e6d8a93a6_JaffaCakes118

  • Size

    960KB

  • MD5

    14760af468d576c8d907305e6d8a93a6

  • SHA1

    e14f4a96e740fd506050066574d81651cfecf501

  • SHA256

    cbe1b54a76079e6759395fd506f75d34fc6691ac84ac1e59b39a5fabf121fca2

  • SHA512

    3cffe0933a4ee9def37d03dc9f952f33456ba996b6fef86ca22ec8facedb3e56eb2f1e95763b3763d47bb4b38c141f6203c84aec7b30c54d34c3d9372a78921a

  • SSDEEP

    6144:21x2z3feWK07em6bgQW/iMCp2BNQzPJoSxeMPD8Rcse5AC7DJmeXGG50rwRKDY8W:2W3pZCRPMCpN4MPDUhdIceXJRRKsO6f

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2