Extracted

• • Target

    5.vbe

  • Size

    10KB

  • MD5

    9c14957ca39752cb13dc22d7dd0e53c5

  • SHA1

    7db0b08452db448b7a022fad47e0aaad42452086

  • SHA256

    462a96c1ba1050085eeb4e15753a8d9b29fc88b2289c996fb937c4390be3a393

  • SHA512

    36c66dfc4b48bbed8c04bfda1bb8414fae6af3199b77ce58e80334e9c12fdb7ab8d3134bd4e8c473d0367555860e989f9e77d4973f6e4636f28d5b350f18113e

  • SSDEEP

    192:xVNM3lLrcABBqcDsPdSuXZlzrZ7gmUWoZl5C8YleLMl/1uw5YOAxJSHtK:DNElLAAKjBLf1UWobMrlwMl/mAHU

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2