Behavioral task
behavioral1
Sample
1996-991-0x0000000000460000-0x00000000014C2000-memory.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1996-991-0x0000000000460000-0x00000000014C2000-memory.exe
Resource
win10v2004-20240709-en
General
-
Target
1996-991-0x0000000000460000-0x00000000014C2000-memory.dmp
-
Size
16.4MB
-
MD5
b03fd8e9ecc70f2ce935b2efb85577b8
-
SHA1
035f3dfaf7c053bfc20f3a2a9ce9932bd561f707
-
SHA256
e8a5e2218a73ba4a426af9c825c3772de2ede21adfdf056c4dd65337f411306a
-
SHA512
bcecbf128c4212c6ac15fe03a5dccf07ba67587fa95f149df2ba41d7d8e0a7969866d2cd561f10b68d148fd6cbfd6bc73eb137c0746d4ca3f3478353eb623a91
-
SSDEEP
3072:6vDdI8Ca564+4V4v4z4G43424A464y4K4v4f4u4A494V4t4w4H4j4Y4Y4s4P4W4k:yIxafbfldRb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7403026399:AAFfphUcCNwXUYyJxcHC8R68pFj9jInz4Bk/sendMessage?chat_id=6419839739
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1996-991-0x0000000000460000-0x00000000014C2000-memory.dmp
Files
-
1996-991-0x0000000000460000-0x00000000014C2000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ