Extracted

• • Target

    fe8e4195973d2d1b1ba23a61a69b28e3_JaffaCakes118

  • Size

    615KB

  • MD5

    fe8e4195973d2d1b1ba23a61a69b28e3

  • SHA1

    d9ee20bf46437de7e9cc4b08c0937b5811949a73

  • SHA256

    2fd10a5668dd0db96cccfa34d4c16e63cbc65c62cd5475b22168f46b787ce559

  • SHA512

    8fad8495e14ad02498f149fd3ac8a82b582a86dce6d5f6c5d0f8f39e8c7b7b610ff9d66b39b2786653974a87122fb8681308cfe0ffa50240da5d3ddec3c4a8a1

  • SSDEEP

    12288:TK5YF12sAqcOsEVQocfu0fpzyejlurXZ6Xdxbr3CKtsMgar2p7NmeNJ:TKMh0d5DN1W7

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2