General

  • Target

    2024-16-0x0000000000400000-0x0000000000426000-memory.dmp

  • Size

    152KB

  • MD5

    27b432ed2021eed458b93f968999486a

  • SHA1

    1790d52f4c8cb3a1d385dbfd3491cba5a33b96ee

  • SHA256

    b6f25036d480d7f70f5920fa17a1c9727438d0870499671952be00b2391b3583

  • SHA512

    9dda59ce9e03296aac849e0a388bb79e69e3e7f1aed70f8dcca3d1b1a48fefeb5394e907c66b65b71c2accd4f0ba005d8fd2576a1447f553b6e29bc3c63842e8

  • SSDEEP

    3072:inEMnPqsUxLFpl5vGM91K+blqkPmdbwvcX28E3NgbY:gPqskLF9RbsE3ub

Score
10/10

Malware Config

Extracted

Family

snakekeylogger

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Signatures

  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-16-0x0000000000400000-0x0000000000426000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections