Behavioral task
behavioral1
Sample
1000-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1000-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1000-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
7b9bc67278785f1e7e18e0cf2af32e6c
-
SHA1
9d1af0b49b61fc73ab1339f29aa1172acbb5795d
-
SHA256
09cdffd1c40e209ddd5a7addd78d5bd333c978aab422fbcdcb0ca3341536d2b0
-
SHA512
d5e69d5ab3c2c1771a21282fbb058ddd7368c036125482c003457a8f4ca21449a2fcdb2cf1fe9509f95c053695585c07550c21e9de4d5c78b4b500424e9a282a
-
SSDEEP
3072:BDtZElXkuB9mM+Qb73pOExGJwB8NPgbY:Fg0wbr/cHNob
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
silverkeyinternational.com - Port:
26 - Username:
[email protected] - Password:
Key@2020
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1000-63-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
1000-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ