Behavioral task
behavioral1
Sample
dec06cc9d18f85918d79945e80abe374.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dec06cc9d18f85918d79945e80abe374.exe
Resource
win10v2004-20240319-en
General
-
Target
dec06cc9d18f85918d79945e80abe374
-
Size
123KB
-
MD5
dec06cc9d18f85918d79945e80abe374
-
SHA1
440e76a86775ad14f02bdbea79cef813c9ecd652
-
SHA256
7eb4302c92c1de3d5b2cd6467abe82e996c14aa6795f928434206b9ee62cbad0
-
SHA512
30dc1fb4ad6b34caed5f42d68c04beea7e72c290bf6359d4ecd98a94052eb36e68648c0e1accaaa7ed9101d1271ad5c61f1969fa4cc3637fbe9af9d27e2b9472
-
SSDEEP
3072:yyX/GSiowfkrc52Xj9a4/9PbSr/wBM+O:p6fkI52T9blPbO+
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1880141509:AAHjseWsCVnzygKB72YGbdj6S0DpdeKfGSs/sendMessage?chat_id=565072597
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dec06cc9d18f85918d79945e80abe374
Files
-
dec06cc9d18f85918d79945e80abe374.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ