Behavioral task
behavioral1
Sample
1168-70-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1168-70-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1168-70-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
40a50d2da8dece79d0b14341b382f2c2
-
SHA1
8aa8e4bfcdc058f21e92801c44d716ce405f84aa
-
SHA256
b5da2316d6bd7705fe79a733341b24fa76e7d1219ce5dcad8dc733caa12f8061
-
SHA512
592940a94a8fa920691ad0def43cc467b99f12bb486dd501f71abbdcc28cc6c6d0922873ec14c64bc4da6a9385e5ba515b155dcd4ef368be98a53bf0af3a5c69
-
SSDEEP
1536:hdAgzEJRCRjTZ1DN9byfW7xSIU0dMFCsgj4l970DWxb/UaKRGpiOWBQ2MF0Kcl:bAgAEvb97xSIUcMb8ZAwBQ2MFbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5635409590:AAHInAR4dWLcsUes3TU8Nj2UQrEubKrXKLs/sendMessage?chat_id=6163418482
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1168-70-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ