Behavioral task
behavioral1
Sample
844-68-0x0000000000360000-0x0000000000386000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
844-68-0x0000000000360000-0x0000000000386000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
844-68-0x0000000000360000-0x0000000000386000-memory.dmp
-
Size
152KB
-
MD5
a6ef126c2cd644e96f946a69bf67fe7e
-
SHA1
e9f706d5334ed3506f018c979883f05dc41f1d60
-
SHA256
94e4a9cb2b83d6fde93ffcd418188c43da9579f62ee6e83b19f50b6f9a0f6f1f
-
SHA512
e4738e2345bffe3227fc1216d8e00e8f8b35a8dceb963a5ffcc02a6fc86beb346767f0e531ef13f81a285d5e6bababf01488bb9df62a506f02411bde1304ade1
-
SSDEEP
3072:JAgAEcCv/IgOYrvQXdtf444YCRb8wXrwBPO7FbY6:6FyI6ApCRboOhb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6286234727:AAGLNWCUohxDTeC_xB6aUjooqi4WA6eMCGA/sendMessage?chat_id=5772168987
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
844-68-0x0000000000360000-0x0000000000386000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ