Behavioral task
behavioral1
Sample
1760-65-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1760-65-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1760-65-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
e4d26bc0a4dde876a39ee23d24dc8d18
-
SHA1
5d457e0036f4bf71658f175e4a795f8eecc47766
-
SHA256
46f672a72c5061aec4e69df870fab73a697cc779fe81d1cb7cd906a09bfbcd13
-
SHA512
74cc275ba875e45bd0f745105e6feff5e27237367a927d71ad891770a5ab8d02410d21a9b70f70d79b7908a91b215dd4ff56b80fa981aef1851ee2fd5fe727c7
-
SSDEEP
3072:0AgAE/4HwL17Qd8VQC/b8rknhwBOOoFbY:9K44QWaC/bNOMb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6139793960:AAHb1pvRqCPkUdPwQAk890wA9oCHnQ-VPaY/sendMessage?chat_id=935548406
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1760-65-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ