Extracted

• • Target

    JaffaCakes118_e29d79978cd7930da34bd49fdffdb471

  • Size

    244KB

  • MD5

    e29d79978cd7930da34bd49fdffdb471

  • SHA1

    5db126c362578f90a77224659dac853ad9931b6b

  • SHA256

    6e0d4e6ce5081f4bf29a4cff61a47e8d9768286ac7bd347ea2bc448b9234b81f

  • SHA512

    a753076b408568ff3c2ba1f28472eeb2d03bbbb885f005d2db15068a7c41fbbbc80a17262dd9fa28628c4c4137461d32e2e9b3f647a95d4bd8e0bb9bc1c7e631

  • SSDEEP

    6144:ngbDaX+pQ7uDe2bQD3g+UP/hry30vBEZTJn:nghpleCQD3g+UP/sBh

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2