Behavioral task
behavioral1
Sample
1956-61-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1956-61-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1956-61-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
7b0f7010b85cefcf89456cf63539a98e
-
SHA1
ad1620537f1ad805d8089a09107f587f7c0a49c7
-
SHA256
bdd23e1982af26a9fb285e1edb404b3133e72fa213ad2fcaea74d599e53d8105
-
SHA512
987394d13088ef1e3fda6ebdb37a026dd7e74cdf663149ecf0d000b2dc1c42f86406e3303ff436e7e8da63ee30b58f724b068b1393335c61fde491cff460ed4d
-
SSDEEP
3072:8FlAi/s+PkZu0eLT3ps9mKb8WlBW+wBl:YvpBYb1lBWL
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5735982531:AAFBEuf0RTgNGQiM6HzH4TS_uXD1vcwTNvA/sendMessage?chat_id=5118863293
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1956-61-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ