Behavioral task
behavioral1
Sample
3660-148-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3660-148-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3660-148-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
9c509ed5c40a67737a2a40b001049b59
-
SHA1
dca34b74d89b6085d3a0688e21c1cf101e2237bc
-
SHA256
ba488bda5c641c5cc7d3c130484da48d02fa290bbb1ee081f2649f21c2916a9d
-
SHA512
8d04bae485fc9373aa5b6090d673d3153e904c3dc627cc2f00891190840e27bec2f660535ea2f9fc74f37f0c6f57e84bfc95bbb9df17b335f500f7607b63b88d
-
SSDEEP
1536:wmtcOks6s+VSyJrDKfTvck5KLREEPb/UbBegpiOWBPAF0Kcl:wmtcXlsudJrDKfTSREEPb8YSwBPAFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5402813712:AAG__8vfwqo_1K9XHIpxzTR9T7UW4raysO4/sendMessage?chat_id=5034680713
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
3660-148-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ