Behavioral task
behavioral1
Sample
832-66-0x0000000000310000-0x0000000000336000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
832-66-0x0000000000310000-0x0000000000336000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
832-66-0x0000000000310000-0x0000000000336000-memory.dmp
-
Size
152KB
-
MD5
a4a47def52bde4ab762453e5d18e067f
-
SHA1
867c836cb66a7a659a62a15311405fe1715af6e6
-
SHA256
4df98a87157a5af08e1cbe3ffbfef9ba2dfbc54fc6aa4ad4c4bb6a4de817066a
-
SHA512
ba9fd8bb15f4c935856e06b6aaea4fb4af1296285ed371d653c3a88b4de5061d23ec9c50dfbb94935265aa20f5b31c36381f26b1191f30b320a6983168c602b1
-
SSDEEP
3072:iAgAEkoHj/LDdB8/o6b8l9sNwBj2CFbYTWL:fxW8Q6bw12mb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5668568295:AAH9FBPsUuJJmN0iOv2LEcbUxztf6vGGSZY/sendMessage?chat_id=5602554873
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
832-66-0x0000000000310000-0x0000000000336000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ