Behavioral task
behavioral1
Sample
1748-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1748-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1748-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
76dcdb9710aad9473463afa172b7333f
-
SHA1
0fff33ee08e3fbb36f534c0a35bc776836cd51cd
-
SHA256
7a7cef376f6206799e4a5f3775056521644c7c750a2fae55e1439c7c681af19e
-
SHA512
8412c93f9cd44f0e403a1e60bcf275e6979d4519c96e434b994afe65caadfee5832ff93ac09b40ca8c52bfcc44211ef48918b03e4c625c9e198d816443afee78
-
SSDEEP
1536:qAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFJZ2KgLvugb/UK1:qAgAEkoHj/LDdRrgb8b6HwBj2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5478319803:AAHq9LkDUFBRvjOub4YfRlPURZxM59_BVnc/sendMessage?chat_id=5516439768
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1748-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ