Behavioral task
behavioral1
Sample
1184-62-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1184-62-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1184-62-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
0744d0f6b87bff1fd7238250c7a1f290
-
SHA1
b556317cdd2ea5ef7beff092b1a939e7d56c5f53
-
SHA256
e5149f591557608ec8d6fd471a33c19f64999bc5b775f18777b018828b627fe7
-
SHA512
9b03b63687bcde1304919e648b255a29c01ff1ec41c64773bbe35a322091704d99a2bab498b8d8a14111496dabb2b246f983261e6a09bb168fc547ae8e57d1c2
-
SSDEEP
1536:2AgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFpVVNAb/UqSCs0R:2AgAEkoHj/LDdJmb8DMVwBj2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6277793502:AAFaTWA4hb8nXcXs5F93eGjEgEZnZ5zoSqc/sendMessage?chat_id=1598812422
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1184-62-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ