Extracted

• • Target

    44d577d9b630126cfc478a5c6c42551b_JaffaCakes118

  • Size

    624KB

  • MD5

    44d577d9b630126cfc478a5c6c42551b

  • SHA1

    53aa5bb04e2196b2f1bf322dbd6e1689640e9b22

  • SHA256

    6f4ba07a2dcc36e96daad9b5a097a6e24a1203c72ae0b6c677c9c0827e466b5b

  • SHA512

    ba94369e1fece4bfbc3c31eb9b297791211e08cbd81db8cefa8e7b2dad4c807074df6d91f8b83e0ccf92ada3202c457e6ba283e2c6de98e50dec5df4d24572b8

  • SSDEEP

    12288:3lHE4QqerJHZtkh3vpyvK+ZMs8eZxicjEgc0HK7z/KRbkfBVpwJNo53Gdujc/Xq6:KK9py9MStoL6kfBVKw53Kujc/XqfaKYV

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2