Behavioral task
behavioral1
Sample
1336-69-0x0000000000400000-0x0000000000437000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1336-69-0x0000000000400000-0x0000000000437000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1336-69-0x0000000000400000-0x0000000000437000-memory.dmp
-
Size
220KB
-
MD5
6591055cf0eb8a58352dc7c2f76771de
-
SHA1
354e77321310ab77439253bc4b8d3f03e943101f
-
SHA256
ccf76740aab0aae57e441375df4f6eb3ab69996a2a3eaa4eb7beb28f3d70f9bd
-
SHA512
32be16c11eb1d284a355509bbd21296547cc62870ac069482fcf085c7bee384fff62bca0d0dbaeecbaee413e2cf8fa33e64ea4c4aa65ac27f075da99f4f9390d
-
SSDEEP
3072:pqqaM97eOTPiK3DruiiF/XbKjPs18lNAgAEzoHj/LDdN8eWLtrkb8YqcwBj2uFbv:oCteODDmzKJmaWT87trkbg2abv
Malware Config
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1336-69-0x0000000000400000-0x0000000000437000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ