Behavioral task
behavioral1
Sample
1332-67-0x0000000000230000-0x0000000000256000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1332-67-0x0000000000230000-0x0000000000256000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1332-67-0x0000000000230000-0x0000000000256000-memory.dmp
-
Size
152KB
-
MD5
0fe6343d22ea25203cfd2d1bf1897bd6
-
SHA1
71aacb7e3f3b3d6d98cbc345e40479ba5daa65c2
-
SHA256
104d294df031b4809d69ff6a5fa9d8e5f37c002de2048342b85e7ef5545233a7
-
SHA512
4b9c1248dbc930cd4d164bf08a5e1ca24ef46edd422cf5f82e0d51edc9311bb08b81df34c899b466055c158368562dc7fcc31e6b8f7ddd43ab5fe8e787880dbc
-
SSDEEP
3072:nAgAEzoHj/LDdsBr1UtEFib8xRqwBj2qFbYcH7s2XI:MaWaUtHbGD2ebvq
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5122580304:AAHkCWB9EFavZMQfS6pgdGmtEGk1zc21s0Q/sendMessage?chat_id=5138702702
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1332-67-0x0000000000230000-0x0000000000256000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ