Behavioral task
behavioral1
Sample
940-234-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
940-234-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
940-234-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
e789baec9f1bcf61ae7de205e11f1211
-
SHA1
274ebaf0a4cc7f22aed303b6873d121165119ffb
-
SHA256
1a814f74b7c2bd713c6fa074dc6e669403d44e2d84d16d29066b39a37dabab0f
-
SHA512
6dfa0e78385a9ed62783143a7c86ff16aa1b6ef35724eb94eb181f2bc8797dbe0347c617508c011c7036f269f93bde95196d2d345c06b816500e2b9106df26a2
-
SSDEEP
3072:HAgAEzoHj/LDdVtp3nXb8/ZdwBj2KFbY:saW/XbW22+b
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5641589629:AAE7PbYkX7JPIEd1r5HHvkG2FiDsJ1HpC0c/sendMessage?chat_id=5609091537
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
940-234-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ