Extracted

• • Target

    f69d8f7707fd214fad1dbf3f1f1765a9_JaffaCakes118

  • Size

    556KB

  • MD5

    f69d8f7707fd214fad1dbf3f1f1765a9

  • SHA1

    2a06deaf1ad3da40cd72528e04336f6bd0f16871

  • SHA256

    0efc0d67d9be3cbc40ab4ad49b85d9cc4bb5997211899feb7437e427831015fa

  • SHA512

    916994ec83f490f64a7b72ef4fead205d96d95b0f7fb0437af1e2adb9bc2254174fc58e2ca902efdd6b5f2046183f591a7d0800bbe853e0417d2ad4ea7263cd5

  • SSDEEP

    12288:QSgWYL9+BCta5h7woBS4y721TlFLnccwFuz4MFeuu3qAM2ZAZ3DWjitGginvQj9O:QSgB9+BC8ZBS4qHurFeuq

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2