Behavioral task
behavioral1
Sample
1260-67-0x00000000003E0000-0x0000000000406000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1260-67-0x00000000003E0000-0x0000000000406000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1260-67-0x00000000003E0000-0x0000000000406000-memory.dmp
-
Size
152KB
-
MD5
c4f4a26dcd74e283df899e154b580718
-
SHA1
9fc94be3466c050cc4a1846e63108c81d5f2d972
-
SHA256
9d495db6ae7369ba6a581e57284ab0528f3837acd5e71efbfee0de4d5a645b76
-
SHA512
a5ac31f771b819c4b85e088b98047a5a1b4b2f375fa138c5dc11cc677754297578d500c4a67df00f2bc30d38b3a59f0efa6b5c3cbf5459a80c66192b14ae37c0
-
SSDEEP
3072:LAgAEzoHj/LDdN8eWLtrkb8YqcwBj2uFbYuqqu:oaWT87trkbg2ab+N
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5972904963:AAH_L0Z1BaWpBDyPhmUAMb5yVXWF00k11jk/sendMessage?chat_id=5334267822
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1260-67-0x00000000003E0000-0x0000000000406000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ