Extracted

• • Target

    d5f2b6db6463048232e0aba9880cd649_JaffaCakes118

  • Size

    283KB

  • MD5

    d5f2b6db6463048232e0aba9880cd649

  • SHA1

    87bfa2ca736a11a60c79fa74481447715ca57920

  • SHA256

    cee16f97554960178a201aad26469926cd079a4254c0f3c420b01b59589f0712

  • SHA512

    68f8aedf3cd9a2c7ffe9875e46b30b429f46d9bfa5b8f428797b47cb620fe6669e92b8071dff3b8e78e24c5c51cc3a13abc26bd4c0f5485e9157a103e08d2eed

  • SSDEEP

    3072:JCVQiibkIczSKQUnNw6KiGhGPETM5tklaY5akt6FB0TvqHCM6FrW4l248V3FMrFd:JfiibDbOPCMHtyABrHCfFCVdKrL

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2