Extracted

• • Target

    1f70ce5c67b3381a16c9edcd2ef16a04_JaffaCakes118

  • Size

    770KB

  • MD5

    1f70ce5c67b3381a16c9edcd2ef16a04

  • SHA1

    1f3746b68606f3ea96735c4af90df0e96d6b1ea2

  • SHA256

    474f66d3344f0a29d6484ab7de9e11e6a293a5d5c719508c91b9bc7d673ce545

  • SHA512

    e537fc2f58f9cb314a8da3319c33a31c151bf47283f4822cc5204192f2b51d11a4a02c3c12579ec14b955d9c1a0846e3cb568b86bf416640ea4b800e8cb7aa68

  • SSDEEP

    12288:qi8ztcfLUVq0OwHK7zz9NzyT0wlWSMZmbhpmXSzf2FteyC6qn6m5U85O:qi8JKuOnnvWfnhPisyg5

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2