Behavioral task
behavioral1
Sample
1644-67-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1644-67-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1644-67-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
524e7454199b959b145d941941daecec
-
SHA1
b924727a5111ef2a6db8bfad719b24b262a6834a
-
SHA256
e24706b77cb4e7ae303a3ec01ea2746abaaea9fdba1d0526c7f777cf71328e0b
-
SHA512
eda887d865eaaf236e7c802fba0be140b719a1eba1a553d7669e7fe721a444847badd160d1cac733d4a0cd959c51108efe4b645c02952dc4b0e080d3118737d0
-
SSDEEP
1536:7mtcOks6s+SqUPjOi3HlSNY2NZTb/UcYwD+8vBmJpiOWBc:7mtcXlsYUPjOi3HUnNZTb8kx6wBc
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5582701255:AAG6EwFmBC6AWDB7ijWIdb3jOpyBEYRlBgU/sendMessage?chat_id=1856108848
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1644-67-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ