Behavioral task
behavioral1
Sample
852-58-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
852-58-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
852-58-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
499dcdb836ac5ae234f08c22c83833f6
-
SHA1
c881f20c960b9e2417f9d7c11e0c305271945d35
-
SHA256
29a53b23b0f9ffc413d5d5cbf21ea8cdd5ed34619a42184d766adf818e4059ad
-
SHA512
1181d2991af1f710a1d0c785f99838c19e641570a5c473c3c356a6c70f4619863fc45527d688b3ffda990c1592b19c9072d952d326eeab77c2f2d5e970637129
-
SSDEEP
3072:iOOYz2CB+Lq9UZVahqY1z1b7TpkxAwBjb:DzVuu1bhkZb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6184780923:AAHbCGrBU_2zg9A-73yTyKKCMGf1tkzUFbM/sendMessage?chat_id=759814203
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 852-58-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
852-58-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ