Extracted

• • Target

    53da681895a602bbd5e900fd9a2ebf7f_JaffaCakes118

  • Size

    484KB

  • MD5

    53da681895a602bbd5e900fd9a2ebf7f

  • SHA1

    a9a64f1234b5d76093debf58321bbda3cd65afc9

  • SHA256

    f70645686b23dadce3d8bb102a514833b32c8480aad0102ee50420ddfaef4a32

  • SHA512

    c788d2967a8ba3bf5e9f32ca7cd51cbe09648455bf8f5aae933da67a9d3d6467679b41367b4a719cbfe69ba02e023b44ea39ee792162c19e358bf9c832280ace

  • SSDEEP

    6144:KKMh/NAJK9Rh46uqsV50zthWFhFqY0shl8qYO04:KKMhvsV0zt4t0myqYm

  Score

  10^/10

  discoverysnakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2