Behavioral task
behavioral1
Sample
209214660x000000014000000.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
209214660x000000014000000.exe
Resource
win10v2004-20230703-en
General
-
Target
209214660x000000014000000.dmp
-
Size
144KB
-
MD5
8bfe24078ca58fbe78dfdbdfdcd4423e
-
SHA1
5d51ac8ff48a230aa42bf85b483887454395e8b6
-
SHA256
d423c4220edd99934e6d8d6e895c8866cd7f9c6e782d91902a1c89f12c149346
-
SHA512
1da3697076966ab50c957fb2a7fe9b0509768a040d9bf4e16d3d3913fe9b7f84a30cfdd87860229757ceabc247758cb6b0c57ef145bd213a35137b6259181ad4
-
SSDEEP
3072:6OOYz2l2PIdSd6bmrdbbU0cgcyyrwBjRIDbY:rz+psdbbYgc6Rab
Malware Config
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 209214660x000000014000000.dmp
Files
-
209214660x000000014000000.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ