Extracted

• • Target

    206a03224a36a00955f4c38e8eb1f87b_JaffaCakes118

  • Size

    465KB

  • MD5

    206a03224a36a00955f4c38e8eb1f87b

  • SHA1

    7defa953520e04bb1d9ce3a27771c512e61b813b

  • SHA256

    99b817a41205825e28f6d4f33a574991d19abd8bc2f6d49789f685ef780350c7

  • SHA512

    bcbb33c16f770b1d2dc6eadde2ec7d8390ffb614d8b16e651a00b74c2aa14c30d201c61bb101d61c451973a582548243aa22d822378df8b757545fed1773d314

  • SSDEEP

    12288:XsZtXIIyuA5qe7RZnVEUh37KEyAWJu26E8fpB09/YC9JV:XsZtXUuvcfkJ4RfpBQgC9z

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2