Behavioral task
behavioral1
Sample
1668-94-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1668-94-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1668-94-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
946d97a4df310c701e3ab8e1ee694b14
-
SHA1
54b8f95f74589947127a4a1d69c4aef03443f46d
-
SHA256
5b079d0d538c03b1680fcba0d489117aae4c5c3a625042372c249e49803d7fd5
-
SHA512
5d025fe1ebaaf25bf0aa2913914271ff94cbe02102f24c3b1ed6552bff2d246ae6c9a4dfffecca7c10a0f0503e29dd92b2b7e8bd113fbdb05eecf8fd87baa8c7
-
SSDEEP
1536:kmtcOks6s+sSyJrDKfTvPXwpSxnL6Tgb/UH1dpiOWBP:kmtcXls3dJrDKfTHVL6Ub8NwBP
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5413418879:AAGAIPfyTA90xoGpfgmho11YwulQ18wfiak/sendMessage?chat_id=1351581537
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1668-94-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ