Extracted

• • Target

    73bb954bffd61171407eccae37ad71df_JaffaCakes118

  • Size

    655KB

  • MD5

    73bb954bffd61171407eccae37ad71df

  • SHA1

    ba3e974d0315492d5d24e5b57984f22c031973f2

  • SHA256

    cfb0b7271966cbfe8ae5c270e63669e35a37e7711470d949c9305a1d92d750cf

  • SHA512

    556748e87136949eaaffc80b685679ba683aedc3137cecd578a288fd23671bcda566ee91221d855aee12d0f89d0b95c4082894a73879f492d716157829b07e78

  • SSDEEP

    12288:V4KHaH2iNeHK7zQaTaKUQKHVyVuLfyAZt1BtYaasEZqCgMH86vA:V4KU1blaKUtZt1XYaAZqCgk86vA

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2