Behavioral task
behavioral1
Sample
1292-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1292-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1292-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
7e50c60cfc7722d60ca3e5c3ded250c2
-
SHA1
a4262aa851c917c16a2b49be1c63e5b8a708374a
-
SHA256
2fa96a52c8c9a36e2a2ee5fa2b736f69e9b67712b0f1ac8da2498ffed8ec2c2c
-
SHA512
150c95b4e9d77ee3a545f3b756b9045938a86c629d47e07783909a2074477d8fe51393697e65244a374a127c1e98a3d29685e142f373f54aeca254e2163ab6c8
-
SSDEEP
3072:tJPpyT/d2vu1pmiAR1tMb8z0wBI8iFbY:ZyTV8XbibH8Gb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
rsgraphiteelectrodes.com - Port:
587 - Username:
[email protected] - Password:
EA3fDWq3?RQ2
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1292-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ