Extracted

• • Target

    23a8fd781917ff6a1eb7d65f5b1c7402_JaffaCakes118

  • Size

    797KB

  • MD5

    23a8fd781917ff6a1eb7d65f5b1c7402

  • SHA1

    c7cc78bb3640ddf8f3635d5cbc76b53c566923e0

  • SHA256

    a8ea252fb4e4a33f0ce9804645ee891dd3ae09a4b3527efb4b190a34940e6e87

  • SHA512

    e64a1c6e002d3e6a3ab2ac1b56828139eaa129f8132737baace23f814f49b48a06ebcfa1e786974bf1eae29b2acc3114fa761c2ba36a61d7b8c69b1adc66083a

  • SSDEEP

    12288:YlO61tgmJ6Tta1/DwhHK7z68Y9IoSSQPxDe5CzyDwvZO1:YCTQ1wsLYnMPxDe5CzyEvZO1

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2