Behavioral task
behavioral1
Sample
2501c2438a880c90f6d32abb9d74ab0c6de74fb9cc65049ca51d1dea01c9779d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2501c2438a880c90f6d32abb9d74ab0c6de74fb9cc65049ca51d1dea01c9779d.exe
Resource
win10v2004-20240426-en
General
-
Target
2501c2438a880c90f6d32abb9d74ab0c6de74fb9cc65049ca51d1dea01c9779d
-
Size
394KB
-
MD5
df2af2b199d71ac8960787773ca05fb6
-
SHA1
8c2c16cc450ff3199805ebb6cc1cd843e2c6c34d
-
SHA256
2501c2438a880c90f6d32abb9d74ab0c6de74fb9cc65049ca51d1dea01c9779d
-
SHA512
6c20c8ab662390cf5063a2ed689fc5391b6d7b7e37d36e0792b957c7b43c31b6fc5da9d0cc5657981e1857bc791da0b527ce5fe1711448ba67ab16fde5542ac7
-
SSDEEP
3072:ayswOpfvZ3BdOYOTq6MUqzCWj5vfLuDM2GnB4P8mT7UA6x/AQ:7pOx51OWDzCW5vfqQ2Gq8mT7ULxv
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.zavidovici.ba - Port:
587 - Username:
[email protected] - Password:
12Opc21!
Signatures
-
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2501c2438a880c90f6d32abb9d74ab0c6de74fb9cc65049ca51d1dea01c9779d
Files
-
2501c2438a880c90f6d32abb9d74ab0c6de74fb9cc65049ca51d1dea01c9779d.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 392KB - Virtual size: 391KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ