Behavioral task
behavioral1
Sample
560-64-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
560-64-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
560-64-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
10ebb75508942ef9db103c0734f1b53d
-
SHA1
7021a714f6a705fed3a9e5b22e26c95f77de3236
-
SHA256
4a845bad5cb73745900ba0086e0bbefc42db903be90e31218ce756517afe62fe
-
SHA512
b51083ab6f52f823b0ee306ffbf5a4998452bfcb4a7475892a599dd34029412a30af42978becf6937fdabcc2ae992c54e34df66c541dad3d824c694161d6ea1f
-
SSDEEP
3072:hAgAEcCv/IgOYrvQoLRDb8mYwBWjOzFbY:CFyI6jRDbkOpb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5928295303:AAGuNoBPUTvSleTT4FySvjzDqvqzDvvy0hE/sendMessage?chat_id=5884533010
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
560-64-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ