Extracted

• • Target

    JaffaCakes118_d693f58558538c9e8daf36fbd374db55

  • Size

    415KB

  • MD5

    d693f58558538c9e8daf36fbd374db55

  • SHA1

    25f77f246f27956647f2d4ddab85da100431d129

  • SHA256

    01cccbd3a723331004dbf8de510380d5c328b8f3d8ae936fb4b9dd4f6259e532

  • SHA512

    dc6cc23407f4a25645704202e6b81dd092a972bd7c5123612fed9d3bfc57823534ad443c036f70f1e843891b3dc7f977f002561de2292f2ea7fd1dda8f1e68cb

  • SSDEEP

    6144:YtgFVwrhUEz+16Uqd2GhN+qQcIkG5we2oXitAQ1CZu6GxOeUQuKrDxl16Fw:Ytgw7z+sUi2iNtfdMityZ79dQuktlIF

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2