The DLL IVectorView is heavily obfuscated even more than the previous stage and since it’s not our main payload i won’t bother renaming the functions. Invoke targeted method which is 4uviT2().Load a resource called ResourceFallbackMana Which is CurrentA value 5265736F7572636546616C6C6261636B4D616E61 but in hex.The DLL name is MLan and it’s obfuscated, so i decided to go with the flow, until i found the function AnsiChar that decrypt the next stage. Then the malware invokes () method from the loaded DLL. Scrolling to the end of it, a function call nnn is called which call sss which call SponsorState, this function retrieve a resource call Rara3 and loops through its bytes and decrypt it by calling DismatleCode, the decrypted resource is a DLL. Home constructor has function that initialize its component called IntializeComponent Their are 2 suspicious resources Rara3 and ResourceFallbackMana, so the malware might use them for next stages of unpacking.Ĭhecking the entry point, there is a constructor called Home Let’s first check the resources, it’s always a good place to look.

The malware usually is delivered by malicious doc and the malware comes packed, so let’s start unpacking. It’s focused on stealing sensitive information from a victim’s device, including saved credentials, the victim’s keystrokes, screenshots of the victim’s screen, and clipboard data. Snake Keylogger is a malware developed using.

Getwindowtext github