Extracted

• • Target

    ece18c6e4b98ce3ed6321e2f59159b8401f6797347c7f947f19db53474b51eff.vbe

  • Size

    13KB

  • MD5

    a6af6f6ddf4ddf8b2b7b1f2634383835

  • SHA1

    336a5775a5d073c7f84c3102d4a235354203a5cf

  • SHA256

    ece18c6e4b98ce3ed6321e2f59159b8401f6797347c7f947f19db53474b51eff

  • SHA512

    300223c1c6ef6aab23d10791643fcdf0edf0cfea38dfe72581a76fd461c596f9417295873484df0e9520c6ea1d047c4ff5bc487509ae6f1dbbc98e7a1cf983aa

  • SSDEEP

    384:uEP6YUlp+y4DdVWrXDL6SuvTra0qtRFWSBQXW:DSp+y4ZYvGVvT3qtKYQG

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2