Behavioral task
behavioral1
Sample
1720-64-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1720-64-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1720-64-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
f0a84dc2e6b71d990c22a5f1a9457f45
-
SHA1
c4155923bd7e2cffb6efe291ed10efe0515f3703
-
SHA256
d54693300f0a4e2c7c3815a38477ac91ab61d74be05deb41e50180b20693e2a9
-
SHA512
699a5ca65d41e0f7e374e753974c7bbcb0da8373ab6d2d4c807a68254326568df76703aaa9726cf488a72f66d2b82224e401e50a2cdbb2fd426397088c5910b0
-
SSDEEP
1536:bOAgzEJRCRjTZ13FV2JKVigSlK/3+uMFaMGkkQE5xUMb/UidY4IPkEIppiOWB2d8:6AgAEbtigS0/3Zo0b8IYbMEIrwBS8
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5229864731:AAEV0jOLrI_tfLx-WLBXsih1ys_6gsK9KBg/sendMessage?chat_id=1455975185
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1720-64-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ