Extracted

• • Target

    21378e439c6b7a64fd621939b532ec02_JaffaCakes118

  • Size

    1.0MB

  • MD5

    21378e439c6b7a64fd621939b532ec02

  • SHA1

    2435feac5a447bb51876f7289ea5dc7d1a178079

  • SHA256

    73b5eeaac092661767a2bc0033af565a589923dfaf97380039402a5cfaa57790

  • SHA512

    c00d57a80b4eb2e0b35bac9dbb8a09536d4758c1299366be8261ab5577d823a473ae6c7098ceaf6702ecffbd2ea2091c84d484d074685b18f6ca984fb144f2d2

  • SSDEEP

    12288:AP3PJf1W4jt9GMDh2zcvp7j7Lbxjv7d+7dstjeJKhiP:I3PJf11Xn88F

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2