Behavioral task
behavioral1
Sample
268-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
268-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
268-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
94d6abce34cfa65e3c0bd0f00d5caf24
-
SHA1
57e0bcefaacdab42f4e52a2b711a6d934a8f8fa2
-
SHA256
ab3a97b065a1783135b087df42e37c1a71046597e5409ee572287458c8ab7092
-
SHA512
6eaf3663cb8b47b725d8489dec7cf1be8e81141cddf4984825a439fcbcaabeee3281f1ea02313fd7d63cfdc59922b81f5b6f2a5ae537ca62552f6a03860042d6
-
SSDEEP
1536:GAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFGvaRs5jLWb/UD9:GAgAEkoHj/LDdKaC5XWb81HYUwBj2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6033511920:AAFrXGVOhhmB4d0ZWeKXfm6F5KHoB3dsuMU/sendMessage?chat_id=5530109449
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
268-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ