Extracted

• • Target

    2ec128417a195a19b3622d3816bcf2ba_JaffaCakes118

  • Size

    751KB

  • MD5

    2ec128417a195a19b3622d3816bcf2ba

  • SHA1

    185d43e563137813389a0a32fec5ee8ae8945188

  • SHA256

    2f884ea5e0db8834637e6a97e1a3835d6b205f084b482a15c618989d777a1231

  • SHA512

    032bdd069f2fc5997cdeefd695218ddd9fede08f767e9b0fd903127714965e41a3853b111d70aa1d3d9f9dd44e8d9253dc3cd69f0c5eac311efa26f4035d8746

  • SSDEEP

    12288:2m1ukqhmCQIFXZYqs9tFgMigaw3dKgXK19eI+qKOFDKrdJQpuFBIOLRtwq6tZEcx:2bzmC7bYDt7zdKgXo9LpPKxJQpuguwqS

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2