Extracted

• • Target

    f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118

  • Size

    1.1MB

  • MD5

    f6bf150be5bb2b8f7760cbfb5cff8516

  • SHA1

    8e57b80e0e3d5d1283251d5cbd687f7177bdac0c

  • SHA256

    48390eb59fdea14012e0c48d7036b77356a1ba0318c446d5b75dcc897883096b

  • SHA512

    a68694e2b6455231ab69525283b99ec4ff6a0980f603474f61c02cde3a9b7bb9e9dd3c9d35128efe6ad9d321bf72726f9b62895251caeee39c58ffe01f44241b

  • SSDEEP

    24576:CwTM08xJoPJuaO80BunLet7jsfjTjw5w0TydSf/do3h3/AXdXKO9VpAPqv:CwTMLmJua2Bu4w7Tjyw0ldDQ

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2