Behavioral task
behavioral1
Sample
537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe
-
Size
127KB
-
MD5
26f6b83f00ede490164483e6f396a7b4
-
SHA1
0f14bc46b93ddad1bf071b28b578e8489aaa3787
-
SHA256
537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0
-
SHA512
7aa0ad7b1b6d48bbb96b74619cba64cfdf4a7bce8fd0779b9dbd8927fb29a52b270150bb5086c20cbc0d883fef239d5f6f1ed4f7d68f696f64306bb327986f44
-
SSDEEP
3072:VJemedcYJyJUq2YuVAbzoZObCp4IwBtXnbY:VeGVTumbbJ3b
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.algodontekstil.com - Port:
587 - Username:
[email protected] - Password:
Alg001453 - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe
Files
-
537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ