snakekeylogger | 4980-138-0x0000000000400000-0x0000000000426000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4980-138-0x0000000000400000-0x0000000000426000-memory.dmp
Size

152KB
MD5

1710fbc3fe9dbb4d022a1a1d2906fdf7
SHA1

364f88d1d4c1fa01a8122e85f469bd931bf8ff7d
SHA256

523a116f813f7b6c319d2eace070b4ebd6efb7ec79a956dda58fb4b673753d5a
SHA512

58c1c88412515ec8bdf76b795e6349854af5293d126815068d741c762d575c89b58e5bc7ee4d38c6fd42634ae88476780f6bd71a630fb0a2494837b67321970b
SSDEEP

3072:OM140KKhDcwKUuElsE2b8gKLcywBVj8HFbY:CPQKLE2b3Kq8lb

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.impressive-edge.com
Port:
587
Username:
[email protected]
Password:
dGpCBydjt
Email To:
[email protected]

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Files

4980-138-0x0000000000400000-0x0000000000426000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ