snakekeylogger | 2868-66-0x0000000000400000-0x0000000000426000-memory[.]dmp

General

Target
2868-66-0x0000000000400000-0x0000000000426000-memory.dmp
Size 152KB
Sample230728-aj7bdabb6t
SHA256 b0dab9f3a5ff04ee4e6fba16a23cdbb12746ae786c6ad5847c724fdd3d69c408
MD5 6f4abf99942a33ea26bd9fbeb7cd5269
SHA1 6d7328d6a768de0569dc86ffca5d4f28a7ba0f08
SHA512 6394d2089c5b7e0e0d964ae55b5512d1b7251f7d720822beaf177e3914a03f1d71ab20151be5163cdcf23ce47c406c6a30fc065cdd86bc896275cf7c73b18ad0
SSDEEP 3072:KOOYz25B+Lq9UZVEO3W5bZj6Xb7l3/wBjb:bzeueqb5ib
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5992278688:AAH0RA8GWViJJa-CiAi72KATgNfdnPJRnZs/sendMessage?chat_id=6085461303

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2868-66-0x0000000000400000-0x0000000000426000-memory.dmp

File Explorer

2868-66-0x0000000000400000-0x0000000000426000-memory.dmp

.exe 152KB

2868-66-0x0000000000400000-0x0000000000426000-memory.dmp

SHA256 b0dab9f3a5ff04ee4e6fba16a23cdbb12746ae786c6ad5847c724fdd3d69c408
MD5 6f4abf99942a33ea26bd9fbeb7cd5269
SHA1 6d7328d6a768de0569dc86ffca5d4f28a7ba0f08
SHA512 6394d2089c5b7e0e0d964ae55b5512d1b7251f7d720822beaf177e3914a03f1d71ab20151be5163cdcf23ce47c406c6a30fc065cdd86bc896275cf7c73b18ad0
SSDEEP 3072:KOOYz25B+Lq9UZVEO3W5bZj6Xb7l3/wBjb:bzeueqb5ib
MD5 SHA1 SHA512 SSDEEP

windows x86

Snake Keylogger payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132798

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing