Extracted

• • Target
    BUKKKSKS.vbs
  • Size 754KB
  • SHA256 d0923cf35bb3beecede53797355af1eed014c6ed550320cfde1204f95d9da939
  • MD5 d007b71d96d81ef4770114857c7071cc
  • SHA1 5b28c5b2980bebe3aca7a712bfadba3ff58bd89c
  • SHA512 93304799ceab97d4b92e8c3987743318e1f6bbbdf1b3f336677edaf59700021dbf4f0bd0ddb1dfc6044c36591f40a9893497f76eb3ab0d4e78fc3eefb619c60e
  • SSDEEP 1536:Tq1laktLucMmxKMMTsljucA7tAuthaEp9P6ZVI+:V0jucA7tAuthaEp9yZVI+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2