Extracted

• • Target

    d28d7aca2535db8b6acea23d96f49d0a_JaffaCakes118

  • Size

    822KB

  • MD5

    d28d7aca2535db8b6acea23d96f49d0a

  • SHA1

    54458aa08d071bab4ff1b9b128754c852ee3f7c9

  • SHA256

    4d98563c239f53f4181159da9c54738b2a4282e4b2070c246ec2333a3b32f4c0

  • SHA512

    d9a4ea0fb57375b8d7903374f92c8ffa88512bf53f7a8bbc9c7046fa51d9d48d634e4408f6808dd4d5dbc1444235e7e1939068c84b3fa15795a65faf7129d645

  • SSDEEP

    24576:3+KkPp9AR95ym9q4W9X4vCcO0x8OT4JS1:wPpKRyR74D7TE

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2