Behavioral task
behavioral1
Sample
4816-163-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4816-163-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
4816-163-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
984ed5cf7cc81172e93983645908e9bf
-
SHA1
c1969022b943e9ee4bfa38badfecc348c487ce78
-
SHA256
ef4bbf31f40c04e854aa11846746784d6f9db3a41a2d75c8184804eec33877a7
-
SHA512
acefce58957e9d3cf05085039a35521e979ac364c8fa38b2645cfd853d9a60736985b35c5386de7c79d275150fc651838f19906ca9b854cc66df58e0ede8f21a
-
SSDEEP
1536:tAgzEJRCRjTZ13uJjuBYHjrl+vBUFrlYYsM9CAZiEqxUM09MFxKvkL1djKlRE9b/:tAgAEzoHjBsMpvMrb8kWYO7wBwOAFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5816308075:AAFAHgyFsBJDNSX2LHn4UAAqe1sHrGMznc4/sendMessage?chat_id=5857548246
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
4816-163-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ