snakekeylogger | 2680-142-0x0000000000400000-0x0000000000426000-memory[.]dmp

General

Target
2680-142-0x0000000000400000-0x0000000000426000-memory.dmp
Size 152KB
Sample230718-p4tcksad32
SHA256 924dc9f9769a039915c2abe4d6e8f3d9a470599baae54b0d6c109a2ec4afb371
MD5 06b728efed031574c6f01329bb571ca3
SHA1 98f79d60ba946ab161bd1f6bce97feb6486119b7
SHA512 70eb6302464dd589e33b38bcd58f7a87c27e3920033ad2e6fdf2ea3e8d43e09ba6168ede8639f32d129dcccf5ee2a085266140d4d9acc7a1c5cbde68fd2dbe90
SSDEEP 3072:rBjbK/Pcwyly02GEU+tqGYb7S7kkwBVjV7gbY:B0E67H7AxbIEVMb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.keresa.com.my
Port
587
Username
[email protected]
Password
Keresa123+-
Email to
[email protected]

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2680-142-0x0000000000400000-0x0000000000426000-memory.dmp

File Explorer

2680-142-0x0000000000400000-0x0000000000426000-memory.dmp

.exe 152KB

2680-142-0x0000000000400000-0x0000000000426000-memory.dmp

SHA256 924dc9f9769a039915c2abe4d6e8f3d9a470599baae54b0d6c109a2ec4afb371
MD5 06b728efed031574c6f01329bb571ca3
SHA1 98f79d60ba946ab161bd1f6bce97feb6486119b7
SHA512 70eb6302464dd589e33b38bcd58f7a87c27e3920033ad2e6fdf2ea3e8d43e09ba6168ede8639f32d129dcccf5ee2a085266140d4d9acc7a1c5cbde68fd2dbe90
SSDEEP 3072:rBjbK/Pcwyly02GEU+tqGYb7S7kkwBVjV7gbY:B0E67H7AxbIEVMb
MD5 SHA1 SHA512 SSDEEP

windows x86

Snake Keylogger payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133086

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing