Behavioral task
behavioral1
Sample
472-62-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
472-62-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
472-62-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
677d6a53e0ae0ec2d0a18ae1cafa8f5e
-
SHA1
db13a1c54e0afbb07f926978a9ae14dbaf5b5154
-
SHA256
9cdeac3aa9a346f2b474b5cf16f912962f313e8a54f91fc6569e42cf450dc739
-
SHA512
2b6014212d438a58ce9daffbf0f49f02eea856c50ff956748c5b9219baebd3db31393d4f6bad4673cba63e4d46ec481ae18cc087fe10d1f7a3944f985fc14d7c
-
SSDEEP
1536:2AgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFTxv0kQAZlimb/h:2AgAEkoHj/LDdXDQAZlrb8PBowBj2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5811582374:AAH6rENVkxUY-cpsSQvER66GI_XclbHAV_w/sendMessage?chat_id=1326296042
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
472-62-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ