General
- Target 2026-09-30_2d696c00c4f9d44972f0263369795711_elex_hive
- Size 4.6MB
- Sample261001-vb858atvgt
- SHA256 2c45ed3b060d12ad74cab8bfa051b0910e899623f78aadb9207c782f87c24bdf
Score
10/10
Malware Config
Targets
-
- Target 2026-09-30_2d696c00c4f9d44972f0263369795711_elex_hive
- Size 4.6MB
- SHA256 2c45ed3b060d12ad74cab8bfa051b0910e899623f78aadb9207c782f87c24bdf
Score10/10-
Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
UPX dump on OEP (original entry point)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.