Behavioral task
behavioral1
Sample
2960-46-0x0000000000490000-0x00000000014F2000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2960-46-0x0000000000490000-0x00000000014F2000-memory.exe
Resource
win10v2004-20240709-en
General
-
Target
2960-46-0x0000000000490000-0x00000000014F2000-memory.dmp
-
Size
16.4MB
-
MD5
06445b51ac9555ea9fb7a148a089d9ef
-
SHA1
1977ffd4c7fd9fc777ce968523c7e2e0b2bc3eb0
-
SHA256
df72e903f017bb6dc25ce90dd68630e056c6147c58290b3b9a72a31541a056c0
-
SHA512
92c9fadef7d727e56fd7cd8684957c834be272e4f92a755014da589725132f34e1b8f3562f561021045ab41d83d9c2875522856f3e8a91b84d99dd8aa8a52a2a
-
SSDEEP
3072:YvDdI8Ca564+4V4v4z4G43424A464y4K4v4f4u4A494V4t4w4H4j4Y4Y4s4P4W4G:AIxaabHdCb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7403026399:AAFfphUcCNwXUYyJxcHC8R68pFj9jInz4Bk/sendMessage?chat_id=6419839739
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2960-46-0x0000000000490000-0x00000000014F2000-memory.dmp
Files
-
2960-46-0x0000000000490000-0x00000000014F2000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ