Behavioral task
behavioral1
Sample
1280-77-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1280-77-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1280-77-0x0000000140000000-0x0000000140024000-memory.dmp
-
Size
144KB
-
MD5
14551255004b036c9746e1b838f15532
-
SHA1
7939f316e5a6b489bd4b5335132527be17e55986
-
SHA256
4b4bc79afad37b6862f1bd314deb6b622347ad8f6e879a0b678bcbd3e775952f
-
SHA512
304bf27d0b43b23f325626e84822fc3ebdac16bc823e64a23e1f232e7ddf4d32fb65d31c45256f24e401ce01238ea56c944e308d35b7000302b51d9ca0fa3ea1
-
SSDEEP
1536:wOOYzPuJbmipA1Lq9ta+vBUFrlYYZVkG8g/MCXY8ZkMFKq/Jb/ctLQ3tpiOWBjR:wOOYz2xh+Lq9UZVVxbURQ33wBjR
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5880456490:AAFr-YgeGPyCCU-BDrqTxMMPTvuAWcxgJcE/sendMessage?chat_id=2054148913
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1280-77-0x0000000140000000-0x0000000140024000-memory.dmp
Files
-
1280-77-0x0000000140000000-0x0000000140024000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ