Extracted

• • Target

    ae20ae4b8b36170ee0fb8654902d962e_JaffaCakes118

  • Size

    811KB

  • MD5

    ae20ae4b8b36170ee0fb8654902d962e

  • SHA1

    bd1900f3400bb00b62241f806e10296a783e289c

  • SHA256

    aacc4ffd4879c92125c613f8a8abd7ab81789581d2305e162efbca3ce23ac180

  • SHA512

    382970ddee385fbbb1e96f2df38ecc69cb1ee2b57a356f374b1e1c88c26db17d5401c1eece3a6c3cd7c3f7b624937187aa83c81c59d14991cd1e428d713bf0ea

  • SSDEEP

    12288:Ebq1otKYmdoaRQ44M7wDEmqBRzOyZ+9iW6ZgHK7zXzKboFryF:aq1JYqdRZFKEfDZ+Yn3Kboo

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2