snakekeylogger | 536-65-0x0000000000400000-0x0000000000426000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

536-65-0x0000000000400000-0x0000000000426000-memory.dmp
Size

152KB
MD5

051cbf64d31dbb9e06c88288d05ed807
SHA1

a277d4d2c9f35e9486a0a0ce0fcdeed0cce615db
SHA256

53304d6b369f2c6bf46684b586bbd39a8c7d54dc3b66680ce47445d8b2e70fcc
SHA512

db72360b32bc9bdcd25ee4fe1b753cbeb0953637aef3fd70230a6f99751a56377c46c0d53a97868a12c0f687ccb819b44d7deada458c7ecaa41ddd9ab2fa8d75
SSDEEP

1536:2XyV5JpAEsM1CVC+E5TU5m+nItnb/Uaya1/8piOWBm:2XyVNsTVC+E5T4mM8b8sQwBm

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
kiamotors-khyber.com
Port:
587
Username:
[email protected]
Password:
6sZAH[5ycM0z
Email To:
[email protected]

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Files

536-65-0x0000000000400000-0x0000000000426000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ