Extracted

• • Target

    455924afa33112b4c94ab614a278347a_JaffaCakes118

  • Size

    1.4MB

  • MD5

    455924afa33112b4c94ab614a278347a

  • SHA1

    01ed05d1016a9c9e5725f37f3470cb314df442c3

  • SHA256

    c8ec3993f019e1eb809a9087b55a63fca50e09670c5e7747f499af35869fdd7b

  • SHA512

    1f9e5e82531a6b641a0b460a9213c6fd308e8059bca3b4248483e0789988ecf2fbab5cebc4b2a49eb0bdbc5d4dd68772d397a6634ed2cbfa29b31db9b6b15edc

  • SSDEEP

    12288:/w9XgcivlSgPutqjCnrPMwylOSwdfIhTCEKqDJbVNiYBWT2fXQzDowpNX5tBsvUu:otOvF9Il5eAEdiYBWT2fX2vOf

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2