Behavioral task
behavioral1
Sample
2612-25-0x00000000000C0000-0x000000000013C000-memory.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2612-25-0x00000000000C0000-0x000000000013C000-memory.exe
Resource
win10v2004-20240426-en
General
-
Target
2612-25-0x00000000000C0000-0x000000000013C000-memory.dmp
-
Size
496KB
-
MD5
29f9b184bf87812df0e7ddb3a451b948
-
SHA1
585c875807db381a74240441ec5026ab7eeb685d
-
SHA256
997b22fddb244eeb294aa7c6089a0c46c9b64dc30e887cd6618f2ed9db868612
-
SHA512
0e517945ec9ec231b72a255d8135d9f9ec933ab54c8a3a73c21cc48448dd148adab397385068dbcd2496cef2873187e32eb82067083ddbfc6d276c13ace1f489
-
SSDEEP
12288:ju3E3HDei3oXA2jCXgXLz/HQOqzjW/NL:juU3Hq6oXA2jBXHnqzjGL
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.petrosharan.ir - Port:
587 - Username:
[email protected] - Password:
BAKHTIari4953* - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2612-25-0x00000000000C0000-0x000000000013C000-memory.dmp
Files
-
2612-25-0x00000000000C0000-0x000000000013C000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 469KB - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ