Extracted

• • Target

    519f9833658acf4cbfc0139b990f1411_JaffaCakes118

  • Size

    768KB

  • MD5

    519f9833658acf4cbfc0139b990f1411

  • SHA1

    0067b543a25625c4ebe64e633fbc4a5fb927045d

  • SHA256

    e61a3b81de7fce074598eb722f5d11e2ccd26032eadfc0d7f2170b03e02a2b79

  • SHA512

    c498c9edb4b3f22970614c6402dfde64bc857c273199913f3c2adfa4882c8dc9e46af1d491fed0157705954f3f3593a69b0ee1b158b8460c93001533914b9802

  • SSDEEP

    12288:HZKKsn3qGaNHEyC9/oR9gy5FHK7zUXbmiE+JKTNAOhPI5l1yt8jKOhTNMxst1bHH:HZKKUPp9AR95yAivxtwlwdgMxGp9

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2