Behavioral task
behavioral1
Sample
4b217e79d0c538d6d0e711f20df8ce47dcbb1104d5f4ad7634a4ed70ad0a34ef.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4b217e79d0c538d6d0e711f20df8ce47dcbb1104d5f4ad7634a4ed70ad0a34ef.exe
Resource
win10v2004-20230220-en
General
-
Target
cc47aff040473c50f7dd20e75fc9c722.bin
-
Size
45KB
-
MD5
1a3873174644785ac9cf757cd93e6b35
-
SHA1
0c1f6b55c77c3663515ca9282915ba3f07cd5630
-
SHA256
e6cfa826718a4f9ba8dd5a4bb0ca6d78726c6d3f7a6d579eff56ee7bc051dd41
-
SHA512
9a82a7a5a256ddef7cb8366c8165ba28b55ecfd744fc7c62563490ac1df6895fa58168036719ab8e3d58953359acf4fadb676f6ca57e81b23c6511e79891b078
-
SSDEEP
768:QkmGD+0IbDEmOBB0XYWNlAvVSD1ZpAZ6xcnVrtDwlsNWU4Bs:QkmfbEmOOWN1VhZ/
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6201063260:AAFNunaDOhtoeTfrWIWz56huyZbdHssBU3s/sendMessage?chat_id=5932819427
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule static1/unpack001/4b217e79d0c538d6d0e711f20df8ce47dcbb1104d5f4ad7634a4ed70ad0a34ef.exe family_snakekeylogger -
Snakekeylogger family
Files
-
cc47aff040473c50f7dd20e75fc9c722.bin.zip
Password: infected
-
4b217e79d0c538d6d0e711f20df8ce47dcbb1104d5f4ad7634a4ed70ad0a34ef.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ