Extracted

• • Target

    JaffaCakes118_1eada844f6d267f4451b9ffa8eba6624

  • Size

    244KB

  • MD5

    1eada844f6d267f4451b9ffa8eba6624

  • SHA1

    11144faece06eb2b3c9c7e19ac3c170b66a351f7

  • SHA256

    49e595816d745be34ae53202b5839e72a30d7245321003fe7a37e1d99508695e

  • SHA512

    1ae7d108ea5e92b4959de64702710d8f9941bff341c3d389d5cf54f1eec1d54697de9eee5d65c0e23f9be34700bde582d2b77577fb3ee811a2c7cf950dd9d726

  • SSDEEP

    6144:ngbDaX+pQ7uDe2bQD3g+UP/hry30vBEZTJ:nghpleCQD3g+UP/sB

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2