Behavioral task
behavioral1
Sample
4548-139-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4548-139-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4548-139-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
094780a4f63aa6c7210a494de503b144
-
SHA1
ef7502e7180417aaa955fc973df0f7dce10c0a5c
-
SHA256
7a94124d9b2e6932352a0ff66ce46239963d2b584a941f1737bd9172cdaf7038
-
SHA512
263c3ebafff0463b086be5ff65eeccb963986544e48f05d03c623071b731af8b61bf65c8a672bfe095fb9856a19f84b1ef3f0dd40269bb2910088f77211190fd
-
SSDEEP
1536:SAgzEJRCRjTZ13uJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFq9eQbb/UUcGSiL:SAgAEzoHj/LDdJwb8UcGSQwBj2iFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5801425382:AAG5b4PUEaqNDv5uP9ejZGeIHeuzzOD4IHY/sendMessage?chat_id=5812329204
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
4548-139-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ