General
- Target 2026-09-30_b0dcdf9fd9e91247485502e986723bda_hive
- Size 6.1MB
- Sample261001-jpvzzawdnf
- SHA256 a231fc019c3f2d04005b69c00eba0052c2cf06e0dc0f542399c4dcb9845b22b8
Score
10/10
Malware Config
Targets
-
- Target 2026-09-30_b0dcdf9fd9e91247485502e986723bda_hive
- Size 6.1MB
- SHA256 a231fc019c3f2d04005b69c00eba0052c2cf06e0dc0f542399c4dcb9845b22b8
Score10/10-
Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
UPX dump on OEP (original entry point)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.