Extracted

• • Target

    JaffaCakes118_43f6b23871c444e83c21659cdf178432

  • Size

    445KB

  • MD5

    43f6b23871c444e83c21659cdf178432

  • SHA1

    3e36823c8c0559c999751c60108b92c94d1e01bc

  • SHA256

    ccb998b0a850d4c9cd99f43f12abe761606ebb47b2d2f010133825561abe79eb

  • SHA512

    73e84000f6aef2fcaafdbbdbebd55f87fa0bbac22cf63bb661f938a2cd48ed33c6e22e5cc67ff2500e7103a3546abc00af2afaaeaca662b84094c9e61b5d6bf8

  • SSDEEP

    6144:8GxhLHI5iv1zNXtHA0tMXgC/pN0LUkQpzY7twmHaqzJG/RN/:VwsXtHA0At//kQpMtDHaqzAT/

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2