Extracted

• • Target

    73ce4ddc5681f4aefbdc4353d1a085d9_JaffaCakes118

  • Size

    1.1MB

  • MD5

    73ce4ddc5681f4aefbdc4353d1a085d9

  • SHA1

    57c15f435d3d5e95500cf4d6affeac26caca97f0

  • SHA256

    0352c89c378617cc060c7685bd67e8ddafa1204055d130a00d8d3077e60e93db

  • SHA512

    3db78438ac033d025f40175af963220244285333cd4c4d26805e414d11892392f11c872593ccdfe87a67af72ff1ae9ccbbae8451f610680977035ba7e5d7c0c7

  • SSDEEP

    24576:EvyMIPEymY0zdH8FXOL7sYDh3NvbWKOD8RUuweBpQrKyMzdooooooO6cF9:IyMIPHmY0lkX67pD9NRpQrKyMzdooooI

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2