Behavioral task
behavioral1
Sample
1368-70-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1368-70-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1368-70-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
0ad784f6acf8511513cfb704fe103b16
-
SHA1
8a1c3881fd45c8237f1a3a8d2a90077aec23e106
-
SHA256
5f809dabeab3037a1d0fcbab9faf3c0901c987c3e65a11454153059d740c4e55
-
SHA512
dbcf526afdd3efcc2e0a2b2a0e0ca7d66b7dc087a0b988b707700863c78dd94c960c89f1c21cc915d41c48267f26b6550eceebbf6e78d570d66071d3adfe0834
-
SSDEEP
1536:hAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFVnVFF3RMWFyobV:hAgAEkoHj/LDdfDRlb8py1VwBj2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5850516910:AAGFrVyywXI7npTHbZn_GIq2nguuXg2t7Lc/sendMessage?chat_id=5716598986
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1368-70-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ