Extracted

• • Target

    680b0b10a8435b833bcd423df49b97c9_JaffaCakes118

  • Size

    678KB

  • MD5

    680b0b10a8435b833bcd423df49b97c9

  • SHA1

    2b7cee955568f6c999e7198a88b275145fff4a5f

  • SHA256

    6cbef3935de6e3aa2f3b42bfe47b0ced92955f6635b14c617025068ebb45473a

  • SHA512

    35565f047e85db6c19fdddc0ed0d8b89e91c06225383f1cf1c67a175ae30835abe61bf1e908144cedfd0cdda696077943ded477e7c428661551743789a8a8cfd

  • SSDEEP

    12288:bmWOE2iNeHK7zDVkQa6NZQbqIWZM66/H3KU4hVJC0j5MKcXmP/:iWz1bWJjbW+66/69hVRCVXmP/

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2