snakekeylogger | 4408-82-0x0000000000A00000-0x0000000001C54000-memory[.]dmp

General

Target
4408-82-0x0000000000A00000-0x0000000001C54000-memory.dmp
Size 18.3MB
Sample250414-trm29a1rt4
SHA256 e07755cabc900c98b2581308f51bf72d281486aca8603864a1f0aac8b2ef0349
MD5 78caa0df3ec646fd5a5d9e6920692a68
SHA1 3e3a5e9985863befefa48c4a27b362ce77d0575e
SHA512 a5fce75a46125d184318b4e77444e1524da456512ee5fd7588d2f14e3c792367b718214d6933c975d3cf743355ad4efafc797295c9fa7bf7cac4c79be639b2e4
SSDEEP 24576:GKAgKjV5Cjbvk5Hbe7fhJN07Thvs+8yd:G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7694680589:AAH7v3RVHta216sxEJEjKVfvPtJtbLd9qY0/sendMessage?chat_id=7987531671

Signatures

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4408-82-0x0000000000A00000-0x0000000001C54000-memory.dmp

File Explorer

4408-82-0x0000000000A00000-0x0000000001C54000-memory.dmp

.exe 18.3MB

4408-82-0x0000000000A00000-0x0000000001C54000-memory.dmp

SHA256 e07755cabc900c98b2581308f51bf72d281486aca8603864a1f0aac8b2ef0349
MD5 78caa0df3ec646fd5a5d9e6920692a68
SHA1 3e3a5e9985863befefa48c4a27b362ce77d0575e
SHA512 a5fce75a46125d184318b4e77444e1524da456512ee5fd7588d2f14e3c792367b718214d6933c975d3cf743355ad4efafc797295c9fa7bf7cac4c79be639b2e4
SSDEEP 24576:GKAgKjV5Cjbvk5Hbe7fhJN07Thvs+8yd:G
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Snake Keylogger payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

136030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing