Behavioral task
behavioral1
Sample
316-1087-0x0000000140000000-0x0000000140022000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
316-1087-0x0000000140000000-0x0000000140022000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
316-1087-0x0000000140000000-0x0000000140022000-memory.dmp
-
Size
136KB
-
MD5
34d2852228bb2b37fa6e57127961af6b
-
SHA1
c04f5fd10c2c9d7a59b1797a9779e33836d26caf
-
SHA256
91d8ca9ad65f2dd7dacf056040cc665ac5e0e8ea607885cd69347fb3a29d0362
-
SHA512
2657d96f01fb206f7433d2324ea4c58b497ecbc59f51d855174d789a2fb744979e035a2ea737b84e2b0065731e8110df7d34c95f20c20565f3e7f55473c87fa0
-
SSDEEP
3072:jOOYz2sMJZjJ3EJx4HbU+eD93wBvUdDbY:wz5/0bSwUlb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6691479601:AAEh3ky4qWjWG1mBjbL2cyHhtHPB2X65D2A/sendMessage?chat_id=6373691592
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 316-1087-0x0000000140000000-0x0000000140022000-memory.dmp
Files
-
316-1087-0x0000000140000000-0x0000000140022000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ