Behavioral task
behavioral1
Sample
1448-66-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1448-66-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1448-66-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
4126a422d820988119e2432740211847
-
SHA1
670e4d6e31d1793235a9515fdfeb2a94998007c9
-
SHA256
4a126b0c4c51ecf913a9c4a891668bf658b3a62937db6c51acd80bd45c4e15c7
-
SHA512
676e4abb38469cf5458cda68e56de59d9acc26718f519031f5718b20e15010ba9972b37a2d0d6d11253a47abfcbd604d70038bda0b3fc89ab9a12b8ee386e99c
-
SSDEEP
1536:1AgzEJRCRjTZ1gVRyqss59m9sMFK/jv0yBQb/U3n08/ATpiOWBU2:1AgAEc7Nss59mWYVb8XPY9wBU2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6025877427:AAEV9pYJpsrdwFYhqW0AuhQDPUMYFVptDtY/sendMessage?chat_id=1467583453
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1448-66-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ