Extracted

• • Target

    ff3570efe3c65339988cab633a78c030_JaffaCakes118

  • Size

    912KB

  • MD5

    ff3570efe3c65339988cab633a78c030

  • SHA1

    1de441e6925118e288ff5cac8bebcaec5b702a46

  • SHA256

    03168de08f30d1ce5eba96f05c4687377bd454405c62484667c7f93d636a6d7b

  • SHA512

    f0339796a3f9b231e9d30101e94eaa859d2bf6e550437bb36dcd83163d105896faa9628e2b2ce35430916f314f9ddba18ccc42d0234a9bfd5ebd57cda1185662

  • SSDEEP

    12288:uWqMOJmbcSMWhT8Dc9F3nC0Py3gAh6N5wOA5t6wOc8JphxOEvpyuntAdkYRbhn05:uXIV8Oc8nhcEhyktu10s8NcJHI

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2