Extracted

• • Target

    f214b97d081f549c3527c0b1f2631b21_JaffaCakes118

  • Size

    759KB

  • MD5

    f214b97d081f549c3527c0b1f2631b21

  • SHA1

    8285783bee73f84baa5c6eab704eaf47ededf987

  • SHA256

    5c48b185c563d651a20fa4c212d08550810f1fd459351ece28509805061b19be

  • SHA512

    489502ad8c27885826729d64669a22eec4ae310af1a85af1c421959e530fe138fe8607c2a5a7af6adf07b1c086321555bc76f1886c6a963d5d6ceea69ae4b1a0

  • SSDEEP

    12288:sqCoL4/HK7zcixJmab3QxFlk+Xr5uP0rbhNIxUFUzfOORB3fAzq3Rc9gOHkOuAig:sZ6fgixJPTq5XrUP0rNaJS+B32q3R4

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2