snakekeylogger | 2056-152-0x0000000000400000-0x0000000000426000-memory[.]dmp

General

Target
2056-152-0x0000000000400000-0x0000000000426000-memory.dmp
Size 152KB
Sample230424-qx5byacb29
SHA256 e4f05de60b93b480c94b3e763cecf9f9bb499d5cb818238bfec46a657b04270c
MD5 9c44507e583b718579352a56f63aa58c
SHA1 85d6d039649c8c5a13230f48ffa00210a9b15f55
SHA512 3b7eb66b77b78a278c319f26941f48c572527db6cb3624796a9d37ba651bc14e0cbfc879ca9094e68c4b5ed0ba11aa62fcbf4e67d70ebc9809cec1059b037627
SSDEEP 1536:NtMpEvqHEIsang0ly+G0/nE+vBUFrlY9DZKkAMFFORnT/G22C7kbKuzPjaQlBUpx:NtMKHE/tDZvORT/G4Qbfrm4B+wBjFbY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger stormkitty

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6029559841:AAEqr8_NCfqapJgAzw8PoPbqoCosnsk1VO0/sendMessage?chat_id=6033043077

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

StormKitty payload 1 IoCs

resource	yara_rule
sample	family_stormkitty

Stormkitty family
stormkitty

File Explorer

2056-152-0x0000000000400000-0x0000000000426000-memory.dmp

.exe 152KB

2056-152-0x0000000000400000-0x0000000000426000-memory.dmp

SHA256 e4f05de60b93b480c94b3e763cecf9f9bb499d5cb818238bfec46a657b04270c
MD5 9c44507e583b718579352a56f63aa58c
SHA1 85d6d039649c8c5a13230f48ffa00210a9b15f55
SHA512 3b7eb66b77b78a278c319f26941f48c572527db6cb3624796a9d37ba651bc14e0cbfc879ca9094e68c4b5ed0ba11aa62fcbf4e67d70ebc9809cec1059b037627
SSDEEP 1536:NtMpEvqHEIsang0ly+G0/nE+vBUFrlY9DZKkAMFFORnT/G22C7kbKuzPjaQlBUpx:NtMKHE/tDZvORT/G4Qbfrm4B+wBjFbY
MD5 SHA1 SHA512 SSDEEP

windows x86

Snake Keylogger payload
StormKitty payload

Minor OS version

Major OS version

Entry point

131982

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing