Behavioral task
behavioral1
Sample
4556-140-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4556-140-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4556-140-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
4ff195297f02c4738f36a3fb50907fa9
-
SHA1
25d2fbc03c7bd2d3b3a0efdcf351d5b72580e769
-
SHA256
07b677d264c01cf11b4119d4a0827cfae8c32df91bd66ea45ffbfa8ce711029b
-
SHA512
a9674801aa38294d530385d48fd3cf98fef6117a5d6c9c719ab2be5212e9760545ceeb7de354edffb759a47876d072acbb4575536038f30f950c3441cd15328d
-
SSDEEP
1536:5FlAi3bCo1sI4SS3Yd/t8yn9wH63kxztET5qWHaphrGbPcs5cb/UInImRpiOWBPT:5FlAi/sSt8C9wHT0cb8EIowB2LFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendMessage?chat_id=1637651323
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
4556-140-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ