snakekeylogger | 3608-140-0x0000000000400000-0x0000000000426000-memory[.]dmp | Triage

Sharing

General

Target

3608-140-0x0000000000400000-0x0000000000426000-memory.dmp
Size

152KB
MD5

e9986d2117be92ecca14df4da8ac4380
SHA1

9a3f53ec0669074506cc3c89ea400e6479fb024e
SHA256

682e818ac326181d7115fff46fc79193972eb7d455b21cdb7bb4f930b1629ee0
SHA512

179c51316228061cb5877dbbc50c9d8b3fe6728a61eb549d7f1266ee6fdad75ada2df32fedcb324016ad5ad8a62d0b0176afc93dc1e4a1b22cf5d2ca1d0ae7eb
SSDEEP

3072:3gz9wohrLzDEyqx+b81j/5/VfB+UsFbY:SXh/XbMD5yUIb

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.glsbusiness.com
Port:
587
Username:
[email protected]
Password:
Delta@2020@
Email To:
[email protected]

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Files

3608-140-0x0000000000400000-0x0000000000426000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ