Behavioral task
behavioral1
Sample
1780-97-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1780-97-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1780-97-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
701e60b9792edf8406a4413b08535f2b
-
SHA1
f65ff7e58c8b351025da135e71f99ae55dc96be8
-
SHA256
ad4ca0fe6278aac7020e5a55458498ae2c5794c695f529ecd3efae948eeb2196
-
SHA512
8833001c3ff2d5cfa8b9abdd6d361dafe3e139745df5d9298c92a27b0240b008548a50a52b2626cb6b3794731d1b0ae0fe6729799772a1b2762a8fae1cda21a5
-
SSDEEP
1536:dmtcOks6s+rWc78k23HybIMJ3Jvdqb/Uu+0DcK9v9piOWBx:dmtcXlsbc78k23HAIU9dqb8+9vHwBx
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5413418879:AAGAIPfyTA90xoGpfgmho11YwulQ18wfiak/sendMessage?chat_id=1351581537
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1780-97-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ