Static task
static1
Behavioral task
behavioral1
Sample
4548-142-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4548-142-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
4548-142-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
3474bf182c7ff8c18e52d89884a96798
-
SHA1
8f263d0fe9db8b6ef4d414b7da5ce85e769cac7a
-
SHA256
2dd07187210e1105075e26315683f0eefa39ac43b9cd261ce372cfdc468f5996
-
SHA512
39507582d6885e2523703a66e131f37ca9e96176d4e9f41519cbf249c1b18916a20c431ce31183f509efdf6d06c791789e9362af67c10170cfbb1ac523f1057d
-
SSDEEP
1536:QmtcOks6s+ZekTZQk3Hfz4+ybzalo2b/UYzoFzPpiOWBVjF0Kcl:QmtcXls5kTZQk3HbSaJb8twBVjFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5516172220:AAH0-Z_MMwZG6EyCl-wEKyJpXEkKGfazFQU/sendMessage?chat_id=5274798743
Signatures
-
Snake Keylogger Payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
4548-142-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ