Behavioral task
behavioral1
Sample
a4643074daa572298d776c00675d4236.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a4643074daa572298d776c00675d4236.exe
Resource
win10v2004-20220812-en
General
-
Target
a4643074daa572298d776c00675d4236.exe
-
Size
152KB
-
MD5
a4643074daa572298d776c00675d4236
-
SHA1
d97dde9378fce06dec1dee3619fb09cf4bf24230
-
SHA256
66579846dd9c447d5af0d729c9cb00dd9703f784e9b08a10fc54a1d841ab28a8
-
SHA512
d72eea6ba86b07cc9eb14b071c00ce7b290b274ab53a81ac6fec783b435f36649af475af89a7a8a33dbf21d40fde4b329f0dff15041c4ca75d9fec525d1e8936
-
SSDEEP
3072:ZAgAEcCv/IgOYrvQDGKjb8RIaqSwBWjOrFbY:KFyI6tKjbCORb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6102267622:AAFFZ_GvUj4OisNxsdlwZ5OHZVEfanDQBf0/sendMessage?chat_id=6107719374
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
a4643074daa572298d776c00675d4236.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ