Extracted

• • Target

    a504bebf521d37c232e916222cca5aae_JaffaCakes118

  • Size

    796KB

  • MD5

    a504bebf521d37c232e916222cca5aae

  • SHA1

    ddfdfdac50c7c098e0e816ca2408ceb9b20191eb

  • SHA256

    853174f43d5517068fc0c16ee89566e5451417d1481ca040f9a2b58d1a7ba7c6

  • SHA512

    73989c8a5247a04105c42cddd3723958176e6f249ce6645b33216b9d4b6466539694c7f3983b68f2056ca227f35c8f358cd90eb781ff51db880e75dc95c59ace

  • SSDEEP

    12288:u8FRcl4t2NjFmzPpcvVr8j7PvQ1TCBfZg5CDeMxNj923dfak/D/hWOeB7Mzp3:ukRcuMNjUcv6Y1TUyKeMxNB6BF/hoBe

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2