Behavioral task
behavioral1
Sample
cas.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cas.exe
Resource
win10v2004-20220901-en
General
-
Target
cas.exe
-
Size
2.2MB
-
MD5
17f40f276c11e20aa841d6f137876505
-
SHA1
4566511541df6f61d1640c50307c6207330cc041
-
SHA256
a59fdce35f3b548d2114f2a7250649067aa3bb246ddcfcf186f111c3a6a6f7f9
-
SHA512
8e48652262aa8a88bbb5af4d9c637a5d7206629b76a44794a2e5a984ac1638d4aee39c86cc8b6b48ad5db170bce224a43bdae3b96a2e6c41c18055494c7b1989
-
SSDEEP
3072:LwGkxshd6j41TgREecCib86DpzhwBwxFbY:CkMublvb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.hemegas.es - Port:
587 - Username:
[email protected] - Password:
@Bastilipo1 - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
cas.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ