Behavioral task
behavioral1
Sample
1620-70-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1620-70-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1620-70-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
01ba873a851b059087af3f7f2873a01b
-
SHA1
eb36197cd43613dc7e2bad69b162f58818e97b2b
-
SHA256
886f514a93aff157920bd8d6df869381ce307860dc3a05bad0e98bf5bfcbe586
-
SHA512
156a27f95ca9b90fa9e2c5d917cac5f940d16dfbfb4553ec077ce05c8edf4b07aafcb47b882ddc32688ea99f2fecb63b35afa5e6b7fe45d15dc8da9b5fe4377c
-
SSDEEP
3072:HAgAEkoHj/LDdhqU/bei8m5b81Xg0wBj2:sxWlfbE42
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6007089764:AAFD9by3UqW3VYmVw-YRcKrJ6hMzB1mxNeA/sendMessage?chat_id=1258525953
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
Files
-
1620-70-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ