Behavioral task
behavioral1
Sample
1712-87-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1712-87-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1712-87-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
e93e6b8e5a16ee48c54a4c0829f4b47a
-
SHA1
76cc044a6fc71813106036efe397d50705a9871b
-
SHA256
320641748d0a0bbaa2b8c52e3729ee2646ca81f3e538813bafc7b9ea18b0baa3
-
SHA512
6e46bc4075a6ca87106d3909ccc733a0d59b7d3787ef7283a4f61bcc77f3ecf71eda2d057ab7dd77ef1fc9ad4d1399941cf3d7b232dfcf3fee328f5ecfcf0173
-
SSDEEP
3072:VmtcXlsd9GDBs3Hw/KkBZfb8kj0wBP7FbY:rJw01JbbXhb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5482516285:AAGlPBTqrQZIPh3V_8aHktxkCcyUbnQR_fk/sendMessage?chat_id=1275946058
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1712-87-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ