Extracted

• • Target

    656cbe89e8de44a171f8e0928dd54c82_JaffaCakes118

  • Size

    791KB

  • MD5

    656cbe89e8de44a171f8e0928dd54c82

  • SHA1

    e53a2c04acc169c30b9ab79555f2cd045dca36af

  • SHA256

    334573b5d45dae9447050cc038264568ae3309ee64904d11ebeffeba2027cc53

  • SHA512

    12c6c99200e9703d4e2e37f80c989dc6845ce47a36a7cedf28e055a6e83d4ab6178b4fd7e08dbc37f1011adf4c9a8af57e0f61bd430c86ef7248ccbc30dffea7

  • SSDEEP

    12288:J/LNKAn3qGaNHEyC9/oR9gy5FHK7zpPZj4RnF6t6u3zk/8uLJKrjuiBswO18q/or:JxKAPp9AR95ylPZystHuUFwo

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2