Extracted

• • Target

    inquiry#60311.vbe

  • Size

    13KB

  • MD5

    ba9acd4ce62eaeead41baefd40d25094

  • SHA1

    110d3215de46fa9cbab29a2d9274fc6b5d302be5

  • SHA256

    9392f0f0a6118130802e67cee0597d20dd9891b426ccf34893e8ff6f5d2bbf5f

  • SHA512

    aa4650d12346ab35f14c123c6b4d66d8fe2e26c7041d54f04ac07f479cf25071e315876c6feeca0cd645145e8bda58608e58cd33a3a261772946354f07f3c613

  • SSDEEP

    192:bu5uz3LBGJzp5PGTzASKFCM1w938tB4E6WAYxNvbEWJ/G4ciT5e/r18vDmFTHRK:TDcTxYzAf80edt4/jZFer18AT4

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2