Behavioral task
behavioral1
Sample
1936-67-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1936-67-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1936-67-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
05b825f661bdc3e84d85e26c91c7e1d1
-
SHA1
25075729c7cc5cb1a98cbf54555d46d0dd906c94
-
SHA256
3e897fea8d19ac6f2bec5dd9908db9a05563920ff42ccce11b5325846ecd59e1
-
SHA512
2a83aee2c35337475797ddd32ebdef6e6c2184b884d169a2a020df0bd1e747ec77151d5e11af9e12c142f86fc11370035955051aa9f3ef6f066343ef155ac24b
-
SSDEEP
1536:ZAgzEJRCRjTZ1gVRyqss59m9sMFeNWTIsOsI1b/U1xkd8l4BpiOWBf2:ZAgAEc7Nss59m6Pb8gd82zwBf2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1897716112:AAEAtOCkOV8umHBB93Og24bkiIdUKReGK44/sendMessage?chat_id=1745211648
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1936-67-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ