Behavioral task
behavioral1
Sample
4588-1095-0x0000000000150000-0x0000000000176000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4588-1095-0x0000000000150000-0x0000000000176000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
4588-1095-0x0000000000150000-0x0000000000176000-memory.dmp
-
Size
152KB
-
MD5
c6c053aee1ef644b986615e5db542762
-
SHA1
bc9b597f2794a115260db5f139066c04eb309af1
-
SHA256
79fa2971e1fa69c1d13de0b2c74ff3add93359377b3105c5937232f644984bfb
-
SHA512
4c6a58d7c42cbbf5d37652c22279287550968edd1c890e9ebfd576fa2605b4ecb849ea690a786cc3d480decced18196fe797a4378f6c5bc41ce516258ba9c588
-
SSDEEP
3072:2UQeSa8x0GIrQs2KcOEMZvb5NXAsLPVwvxdDgbY:hSRxtkvbzyUb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.al-subai.com - Port:
587 - Username:
[email protected] - Password:
A_Sadek1962 - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4588-1095-0x0000000000150000-0x0000000000176000-memory.dmp
Files
-
4588-1095-0x0000000000150000-0x0000000000176000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ