Behavioral task
behavioral1
Sample
1888-155-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1888-155-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1888-155-0x0000000140000000-0x0000000140024000-memory.dmp
-
Size
144KB
-
MD5
0b8235f60ef77ce98998f8d143198501
-
SHA1
cf395087defce8fded990ace60ed70a3c5133729
-
SHA256
eaa44672f83dd9e95dbe7be8ab828997b2df0ec22a30ef620dab4412f1c74ced
-
SHA512
637702a9da896109183d87da56b32572cc20d9a6d31a17c725757c161fdb6d8201683fea0a27040183deeae3cfe76878131e2a664517c4185de6930de5d0698a
-
SSDEEP
1536:wOOYzPuJbmipA1Lq9ta+vBUFrlYYZVkG8g/MCXY8ZkMFKq/Jb/ctLQ3tpiOWBjR+:wOOYz2xh+Lq9UZVVxbURQ33wBjRhDbY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5880456490:AAFr-YgeGPyCCU-BDrqTxMMPTvuAWcxgJcE/sendMessage?chat_id=2054148913
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1888-155-0x0000000140000000-0x0000000140024000-memory.dmp
Files
-
1888-155-0x0000000140000000-0x0000000140024000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ