Extracted

• • Target

    f52532696b6e7074ae190045efca78d973c8b72d6fd8852c61ccba50e0dea1f4.vbe

  • Size

    12KB

  • MD5

    329e1af755bf0dbe171429dd561c1608

  • SHA1

    3a0eea78171cecc5940bf2b110c1c9f8da8c8885

  • SHA256

    f52532696b6e7074ae190045efca78d973c8b72d6fd8852c61ccba50e0dea1f4

  • SHA512

    096b4e5a00333174b0f054736bd11977a85255fc5f1f2d9964f31f132842a8144dffb667af74a5dd575f587287212509037aae6cf74d5973b3e3ea432240a622

  • SSDEEP

    384:tTlEogaI4dPJuUMkRZOeXLe7t1LkHNplbZ7CA:ZqjWJUkGey7t1AHpbZt

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2