Extracted

• • Target

    210f37c353be6b2739eaba795cd9b65a_JaffaCakes118

  • Size

    780KB

  • MD5

    210f37c353be6b2739eaba795cd9b65a

  • SHA1

    20bc7ff1b8e44e954290cd243d5f4eecb165b52a

  • SHA256

    46ace3d6e4ad85d164526928dfc1827743f1f9caa7b46d342e211b807afaf55a

  • SHA512

    ab96d81281aa8f09d86df31dd1bf900097e26778c6e3a557e746478fbc1fd3b0968aa0ea5891ff9f25abec373db9f6becf48edefa936abe7f0f06215b1bda2cd

  • SSDEEP

    12288:R6rKqn3qGaNHEyC9/oR9gy5FHK7z9LQ5rMsYPCy+CobTDcQLiKE3dcF+P5FXpucl:RuKKPp9AR95yZAMszyiTDVWKE3zPX

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2