Behavioral task
behavioral1
Sample
1852-61-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1852-61-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1852-61-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
d76fd2b08b652233be0e6a720096f498
-
SHA1
3a7b756fb58f216ca5a77ae5a6b5d6bdf1a2dffb
-
SHA256
de80105cb51c46334fd8ea5e53145f90c32cf998d1bd89e5e998f3aba615634d
-
SHA512
01df47ef366e1e8f52fe8461bdff51979efb400709c9141bc299ec6b9f3699998dbdd7d3c72e0f13107723ac1022501cfd42606ba5a8645f3c93a785a77acdc4
-
SSDEEP
1536:eAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFsD3DktR9Whqb/f:eAgAEkoHj/LDd+DkVb8Ely4wBj2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5455879159:AAEEslA21OkiC675k778sJZDVmWZA0hIPJc/sendMessage?chat_id=5806341614
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1852-61-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ