Extracted

• • Target

    4ff5e0533b3d8e8bd3dcf3de18e02fd8_JaffaCakes118

  • Size

    536KB

  • MD5

    4ff5e0533b3d8e8bd3dcf3de18e02fd8

  • SHA1

    01b43477d3412a248d23c7c3a832b0e085547ef0

  • SHA256

    1bad27962e547d124508b0d4cf410099897016d06a60ef51badf5fb67b95771e

  • SHA512

    7aa3750a60c334c5a94a7aed749177731863cc680a856b5f59aae3747ff90c4b22a5f7fb469e13b73b9a9dd078cc2444a5d1e0654b04028d5d9611d85680d131

  • SSDEEP

    12288:p9NTD2ltlodV8B80yyHcGS3bIYw18mloELLtd/zvTxBHxFno8:q5flRT

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2