Extracted

• • Target

    5ead7ddae1c6c616326863a2d04f2d0c_JaffaCakes118

  • Size

    1.0MB

  • MD5

    5ead7ddae1c6c616326863a2d04f2d0c

  • SHA1

    1f40c8e71034e887ac50c8fb307ba1e55f35023b

  • SHA256

    1538239719a2e9ebb9fb648f8e7a53bc6c55794f2a8c87d90f5c5d732d2767d1

  • SHA512

    69ee52fb9b1da32fa409e26c3940e097e225f5155364633cf46fc37b69b1d1444a2d2c64b4cfbf73b9e1df2ce1616280b5bac665a4de0ff9260c936598bd4a87

  • SSDEEP

    12288:Iou56/f9mQy5DDC8LBcFg2Dt2NjF3E4SBUXZKSuzesdfMp6n1MjvLe:I1Yl4y8lInDMNjuOIiss6kvLe

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2