Extracted

• • Target

    JaffaCakes118_08a85941a8d0046a663e7d256a3ab9a7

  • Size

    640KB

  • MD5

    08a85941a8d0046a663e7d256a3ab9a7

  • SHA1

    8732fbf5ceb577cc42bc999615922fa5f94ee68e

  • SHA256

    6a72faaec7faf43128490d2bdfef8fa4aff36a4decc7502c81a8eb7482e7e500

  • SHA512

    e2d539a79b0f33ae1a65e773080a0769fbac898f02636a34ab3f927d65548f87f07fbf7d5f1b897f6df254024ba7e5d2ea38e329f0f7443fa4244b73941ad9b1

  • SSDEEP

    12288:av/AYnEyHWiaHzNwsQg/8wvUwLywNaSctMXQ:kYpmQ8whiMg

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2