Loading malware…
3snake is a Linux credential-stealing tool designed to capture password-authentication data from privileged servers. It monitors process events through netlink, attaches to authentication-related processes using ptrace, and traces read and write system calls to extract credential-related strings. Its documented targets include OpenSSH server authentication and sudo, with support or experimental functionality for su, SSH client authentication, and password changes. It requires a rooted Linux environment, ptrace availability, and a mounted proc filesystem. PasswordHarvester is a 3snake-derived credential stealer associated with the Gambling Goblin cybercrime operation, which has targeted Brazilian organizations and has been linked with medium-to-high confidence to Earth Berberoka.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Its toolkit includes DownPro, AlphaAgent, oRAT RAT, 3snake credential stealer, SSH brute-forcer, and reconnaissance tools.”
5 distinct techniques documented for this family, organized by ATT&CK tactic.
When it receives an sshd or sudo process ptrace is attached and traces read and write system calls, extracting strings related to password based authentication.
“The public version of 3snake attaches ptrace to newly spawned sshd and sudo processes and extracts strings related to password-based authentication.”
When it receives an sshd or sudo process ptrace is attached and traces read and write system calls, extracting strings related to password based authentication.
“The public version of 3snake attaches ptrace to newly spawned sshd and sudo processes and extracts strings related to password-based authentication.”
PasswordHarvester attaches with ptrace to authentication programs and reads credential buffers.
extracting strings related to password based authentication
Listens for the proc event using netlink sockets to get candidate processes to trace.
PasswordHarvester attaches with ptrace to authentication programs and reads credential buffers.
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.