Behavioral task
behavioral1
Sample
lfwhUWZlmFnGhDYPudAJ.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
lfwhUWZlmFnGhDYPudAJ.exe
Resource
win10v2004-20240802-en
General
-
Target
lfwhUWZlmFnGhDYPudAJ.exe
-
Size
130KB
-
MD5
9c95bf08967eeecf332c0a115fbb10b2
-
SHA1
041f673fbfc7b4a6087cfb77b04006b290d89a2c
-
SHA256
5be82d63ab051acc246fd9feb3420de47b9f458621e9ad60d2434c9c99e52ee8
-
SHA512
96664601207c663532869bb39687fecd519181338a8ed0966532ce77a01d429201c639ae312a362831a67e17286d6d4add07961e659c2e7166509ba93f3e0b78
-
SSDEEP
3072:FVJg2V2QyG3YZvp3UFbcrwxt5RMVbqwE5K1Kbv4XysDor2vrc7dIbapmWnwvcXmZ:W2V2QyG3YZvpUFbcrwxt5RMVbqwE5K1q
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6756118950:AAGfdfhshYm8ER28iBEbbJy5ae-eVJaOJUM/sendMessage?chat_id=6278563907
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource lfwhUWZlmFnGhDYPudAJ.exe
Files
-
lfwhUWZlmFnGhDYPudAJ.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ