Behavioral task
behavioral1
Sample
6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6.exe
Resource
win10v2004-20240412-en
General
-
Target
52b9cb2e901a8e0694e91144adb2fedef716654ae65c05cdcca298fd3fb9044e
-
Size
47KB
-
MD5
9afe4a2ee1175f491b6d05eee138825e
-
SHA1
4f0ae98eedad168248ff8dbc3609928e5b7f247a
-
SHA256
52b9cb2e901a8e0694e91144adb2fedef716654ae65c05cdcca298fd3fb9044e
-
SHA512
aa6f6676ba699e3f44bf1579d151333e9eba95e6521c391bd18a3d98cf5e72fa82cac91aa4b1c0ee573c8223a47195c09af6066c52f815a6e1f49211535041df
-
SSDEEP
768:8wW75pU+TjDC0deHKjFHoXdpQMG+l7UiA0sdgI0UTKP9N+eJwTfu/VE1lESPXDxJ:8wGVTj+2YzQMrJagfkC+fiEVPDxJ
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
123456 - Email To:
[email protected]
https://scratchdreams.tk
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6.exe family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6.exe
Files
-
52b9cb2e901a8e0694e91144adb2fedef716654ae65c05cdcca298fd3fb9044e.zip
Password: infected
-
6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ