Overview

overview

10

Static

static

1

Fiyat Tekl...26.vbs

windows10-2004-x64

10

Fiyat Tekl...26.vbs

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Fiyat Teklifi Talebi_22102026.vbs
  • Size 152KB
  • Sample261022-e2a34scw3l
  • SHA256 0a0dfd88a061dc8ad13f65954c0c961120bade8ad92f946d10c4bc0bc9c1cf80
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerpersistencestealer

Malware Config

Extracted

Family

  • snakekeylogger

C2

  • https://api.telegram.org/bot8714042194:AAG_8GkJxiY4sU1IdDXt3MUrQN1tLaiphS4/sendMessage?chat_id=7282830258

Targets

    • Target
      Fiyat Teklifi Talebi_22102026.vbs
    • Size 152KB
    • SHA256 0a0dfd88a061dc8ad13f65954c0c961120bade8ad92f946d10c4bc0bc9c1cf80
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondefense_evasiondiscoveryexecutionsnakekeyloggerkeyloggerpersistencestealer

    • Family: Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks