Behavioral task
behavioral1
Sample
5904-1357-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win10v2004-20250410-en
General
-
Target
5904-1357-0x0000000140000000-0x0000000140024000-memory.dmp
-
Size
144KB
-
MD5
e45d89548f7e3d2ebde0bb84bb2e5541
-
SHA1
c2ac4b8d3ebbe22b5557370d2dd474f730fe5218
-
SHA256
3f1bad23067847b68eff904226472c7031b95c9eebd1e2a4aaca5cf1c0f8268b
-
SHA512
72e3fb4bee9a22b49a2dab9ef2cfc9bf1e181e27e81da16ba213903a68e2b010f4c062e07fa1336e94a071aaff5927c2fc83ec69f25a8f4088133c535680df4b
-
SSDEEP
3072:tbLbu8cvR2glJkCfC0CmC6CnCGC3CXCLC/CLC2CeCvCxC4C8C0ChCSCOCtC1CdCs:Nu8cZ2glWLbkgEW/Tb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7364470606:AAEcz2z8Dv2QVAXOs9nVEg5EakMwUvY5Ssw/sendMessage?chat_id=7969902771
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5904-1357-0x0000000140000000-0x0000000140024000-memory.dmp
Files
-
5904-1357-0x0000000140000000-0x0000000140024000-memory.dmp.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ