snakekeylogger | 240904-reqw9s1gnr_pw_infected[.]zip | Triage

Sharing

General

Target

240904-reqw9s1gnr_pw_infected.zip
Size

48KB
MD5

8db534ffd2655c4c30b6a2afab9c7090
SHA1

e6fc46057cb11960bd25d0ddb3346c5c57a7a9b8
SHA256

a97d77499a1b001fdd323ce728bd9ab280a06bd4b8f087dd48b4d6b84fac575b
SHA512

0e3b4c34b5f381ff8457ca334f68fe2247a3cdb3ae99692ab5d9a0c597d53ddf1bd20d8b4b4d6cf883e4accc038bb873941cb2bab98d64e8dfa0e7474e48f2b8
SSDEEP

768:VfXRpkwlUW9DnPtpAcnfJ5I6G7p0Lx/Y4E1twnCz4Ld6/pfaRHZkKO2jjMJR2:pnFl19PtpAW5I6G9OZY4amnb6Rfaqff2

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
bisttro.shop
Port:
587
Username:
[email protected]
Password:
W79cDo2h05Iv
Email To:
[email protected]

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
static1/unpack001/snake.exe	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/snake.exe

Files

240904-reqw9s1gnr_pw_infected.zip
.zip

Password: infected
snake.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ