Extracted

• • Target

    5be2aba8e3484a93cccf568ea1ba3cd2_JaffaCakes118

  • Size

    763KB

  • MD5

    5be2aba8e3484a93cccf568ea1ba3cd2

  • SHA1

    8e8600b237356b40e13e21a651f9e96e390f0959

  • SHA256

    e9195002d43831ce06eaef9e7038e03b557901096aab0d7b7ae34c71783a12cc

  • SHA512

    4ad3df73582edd399159fde11988901fd6fcf1cde64cb796ac7ff88a0cd5c2814bb756baca5e57478ed352b249ce7bc03eea5cf2c6d54c69be276c0f6d237f99

  • SSDEEP

    12288:/DIk6j6c23ez01yiX/KvkvkiKqAH48EEszHK7zYB6b:LIk6HviXSqF78t08

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2