Behavioral task
behavioral1
Sample
3992-140-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3992-140-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3992-140-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
ac077435947c2f7e190fa1781fd95488
-
SHA1
64f92b44f3b8572edfff7eae3044c9a7d45379df
-
SHA256
afe75e5e3c6ba386acd005fb7b0a6e38ef9028d84e2f51a0373fb477ea279623
-
SHA512
4afd7306cd4dcb3db9631c5276f98f7575f98dfc3fb0999518fb7f3c0ee64d987d8abedaa421b65353f4231c7dffb4ec1431703dc65be27789634237ef19f64f
-
SSDEEP
1536:qAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFJZ2KgLvugb/UKp:qAgAEkoHj/LDdRrgb8b6HwBj2aFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5478319803:AAHq9LkDUFBRvjOub4YfRlPURZxM59_BVnc/sendMessage?chat_id=5516439768
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
3992-140-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ