Extracted

• • Target

    e5399ed40f9428a0149b57d996a7b28c_JaffaCakes118

  • Size

    745KB

  • MD5

    e5399ed40f9428a0149b57d996a7b28c

  • SHA1

    04849f967bb906b59be5c57e66c6fde8cd906166

  • SHA256

    5fa4b219229c79211a8ee98bc323c26b132f436622c7187a55e1490a92738807

  • SHA512

    259cb530f0109444efe8e18229ea4ed42564454e7908a9324ece45f63466b6345c44e87494013784bc1bba346c13466f4e86bf0a6a084ddca72ee6797ae658b1

  • SSDEEP

    12288:CbeiOPd4cS7s/M/P5qfHvtwGDAV6ZCwznvHo1sMnsuIjTZ81gHp5pHnjEZ+5MAAK:yepS7s/M/PgfHvtw606VfKs8W1wyTjVn

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2