Extracted

• • Target

    Ref_0120_0122.vbe

  • Size

    11KB

  • MD5

    f2ba7d3b3cdabd02dbcccb1174088b1d

  • SHA1

    dbc02a29b2b042af0b988c698be5be7885e127c1

  • SHA256

    4d89b6fc60ffaa84af321fb2120185994a22605d80d175d71c5780e753d3ec8d

  • SHA512

    876f7a01b9abbaaf7dff88e16a362eafa5ba13b9031c1d6cfef195b426e89c4a287c26d717320886a225d7904aca3635bf3a6a8f2286a5d89bfadb0b330da154

  • SSDEEP

    192:lwZ1ZSTlbLJya3RGALtUtNG7YkGEY9CNsRXX1SAkt0pdzea1iGDcgjK:6rITlbz3L5UtNGWEYCNsRXX1medzL1iZ

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2