Extracted

• • Target

    64c96d9482e68988007c36ff8d3764b1_JaffaCakes118

  • Size

    702KB

  • MD5

    64c96d9482e68988007c36ff8d3764b1

  • SHA1

    4e0fbc417a80ead8e64919d30496f01a227c4f54

  • SHA256

    9c52db7859362b52c325ce724f2edbee2b954a1f9e9bf1f98ae0830abeabe8dc

  • SHA512

    03e90f48e3e9bb489448c7ded268cd7735a542c1d5549c7f58532aeee9f844ae6ce2077072c0ff6c33d257811ab3bd7a32a36cb17fc42fb6542bd33433c8535f

  • SSDEEP

    12288:iPCzeQ2FJQIhc2XRv/fpdY+pjgLwXzlmA/W7SGiYZWUzyYlSeMJqQb9HfoZRk4aF:tzT2vlhc2XRvmgCEYZpzy/qCEk4LKIZo

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2