Behavioral task
behavioral1
Sample
3068-139-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3068-139-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3068-139-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
63d5ccee24655ea2e2f3522b46735cbd
-
SHA1
bf49274c801138acfa276d5bea87a528d8843b2c
-
SHA256
8d2fa512a5c0908e83f2ba23364e0d601460279cf7084ce2f9a952e75b3e42c3
-
SHA512
67ee16cf4d389c146a6901924137fa782052b28da98c5b8c6a84fce84d230156240bc093e7a7dbb9ff0d26222c76cd3c96310ffefa695e8fda994bdfb159e696
-
SSDEEP
3072:sFlAi/s+PkZu0eLTmqSvb8qldwBlZFbY:IvpnSbwHb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5688807535:AAG1DGE6pZTsXCmSWLJMEc1Gjb9GWweDx4E/sendMessage?chat_id=5567956038
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
3068-139-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ