snakekeylogger | 1348-63-0x0000000000400000-0x0000000000426000-memory[.]dmp | Triage

Sharing

General

Target

1348-63-0x0000000000400000-0x0000000000426000-memory.dmp
Size

152KB
MD5

0d650b1ff0e19c6db7ff20fb336686d7
SHA1

a45d538cb2eb4c1b8f6ca0bec2f425de021e25b5
SHA256

1f08359f4dc582fdbb87b1daaec6f50ec091e9339dfa442e04b6e37f79a0ea83
SHA512

2a1776af0dc62479950c4362b067121e2af3de218f11dd661ef6aa605d904734ef0cae4553b19c5807f40f1dae7f7e9c01076c6236a2bfcd544b7dec515b62c1
SSDEEP

1536:F5Xym3NhmTCCFx0bE/l4O+vBUFrlYYuqkaRt2BfTSlE2MFcxffc7jb/UyTdac+qo:F5XygNhi3/l9uq/xXejb8OLBwBI8

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
olgaecs.com
Port:
587
Username:
[email protected]
Password:
0zukpdS7Pgug

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Files

1348-63-0x0000000000400000-0x0000000000426000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ