Behavioral task
behavioral1
Sample
848-675-0x0000000000830000-0x0000000001A84000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
848-675-0x0000000000830000-0x0000000001A84000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
848-675-0x0000000000830000-0x0000000001A84000-memory.dmp
-
Size
18.3MB
-
MD5
db684360114845e7a979163a86079f59
-
SHA1
afd4fd890008f24210588555b2b28c15e295dea6
-
SHA256
fbd0885338014878ca7fae798b766acb3d8202f9098c4ec38b36afd8dcff7787
-
SHA512
b64b628b0be2eb0e5573e0ace31899545c24c2028ece620056b51774fa700edc306757d6d22647b3fb4c305a9ee7c5aae28e173f8fcaf9c9b6eb715e6c3b27f4
-
SSDEEP
3072:4Qz2gTyFbBTbdRWeuOLl8I33kvQor27XWDbag95sLXwvxdB2gbY:DTyFbBTbdRWeZLl8TDb3NBXb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.takween-acad.com - Port:
587 - Username:
[email protected] - Password:
Chelseamel@22 - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 848-675-0x0000000000830000-0x0000000001A84000-memory.dmp
Files
-
848-675-0x0000000000830000-0x0000000001A84000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ