Behavioral task
behavioral1
Sample
2932-9-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2932-9-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2932-9-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
6622d1e2fb3bc358f01b7de0ea62f4ff
-
SHA1
6e162b884a90c80b9e5eb9bb72396d9290a97221
-
SHA256
22d42bdb27c59d6a871cfd3a24ee7567c0fc9a5d61afa3e30546c420912c6a31
-
SHA512
1f87e01e11a949fef71ee17d5102171067facadafae4b32de1edf3213c9266cfa87b847c9c53519ce55d7dbb51714b9de18a879c482bffeccab043ab26b09728
-
SSDEEP
3072:It1PdhaH88ECg9s3X2zb5MHdmmWOwvcXb:WdUd2biHv
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7985379579:AAFFNXAHJz6n24A6xEGgMMms826UxvjorNA/sendMessage?chat_id=6370711846
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2932-9-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
2932-9-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ