Behavioral task
behavioral1
Sample
adf5132844797507cbb4e1ee8bbb22d9b4ec6db0712be4883223787db7a48022.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
adf5132844797507cbb4e1ee8bbb22d9b4ec6db0712be4883223787db7a48022.exe
Resource
win10v2004-20220901-en
General
-
Target
adf5132844797507cbb4e1ee8bbb22d9b4ec6db0712be4883223787db7a48022
-
Size
126KB
-
MD5
86282acd13ba09bb961607f49b7ab868
-
SHA1
7fa70b4b2df403c5c00f25d4bc1e212123639739
-
SHA256
adf5132844797507cbb4e1ee8bbb22d9b4ec6db0712be4883223787db7a48022
-
SHA512
58878bc60b31626dea4b9ad0a7314e725976c4512ea525a0b6192164b726b6f45a8fccf83b3ba0195205edee1534179c3ddfb1612806ca1ba7c2dfee33231b28
-
SSDEEP
1536:5FlAi3bCo1sI4SS3Yd/t8yn9wH63kxztET5qWHaphrGbPcs5cb/UInImRpiOWBPT:5FlAi/sSt8C9wHT0cb8EIowB2LFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendMessage?chat_id=1637651323
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
adf5132844797507cbb4e1ee8bbb22d9b4ec6db0712be4883223787db7a48022.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ