Extracted

• • Target

    63f484e36e6533bce2a47bd946486c83_JaffaCakes118

  • Size

    1.3MB

  • MD5

    63f484e36e6533bce2a47bd946486c83

  • SHA1

    8815f16a19e0f8c29587b241e635ddb66a0d54ea

  • SHA256

    7d6908ae43fb741400ac24a976de03ee6e72a8a306e3fdea805aa4257fb93f1b

  • SHA512

    a35cc546c2c49dce9441e3888474bb206262915bd7df81395d7085fa99ef7f6092b61f0a1c0a3669abcc8c0d8e6a8c67633475d3e1cec244220263e7c3b0bd62

  • SSDEEP

    24576:zlVpguGi7f2lUAa6fUSCl8NOzx6UbW63+sV98VnUE+7nunaIYPrK:zjaGfNA3fUSClpxl53+sV98VqnunaI42

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2