A recent phishing campaign targeting Windows users involves a malicious Excel document that delivers a new variant of Snake Keylogger, which is a.NET-based software sold on a hacker forum and is designed to steal sensitive data from infected computers.
Once executed, it can capture keystrokes, take screenshots, and exfiltrate saved credentials from web browsers, and other software can access the system clipboard and gather basic device information, which poses a significant risk to the privacy and security of Windows users.
The phishing email lures the recipient into opening a malicious Excel file, which exploits the CVE-2017-0199 vulnerability to download a malicious HTA file.
It contains obfuscated JavaScript code that is executed automatically when loaded, potentially leading to further malicious activities such as downloading additional malware or stealing sensitive information.
Attackers obfuscated malicious VBScript code within Javascript code, which creates a script while Shell objects and executes PowerShell code retrieved from a base64-encoded string.
The PowerShell code downloads a malicious executable (sahost.exe) using the URLDownloadToFile API and runs it. Sahost.exe is a loader module that extracts and decrypts multiple modules (dlls) from its resources, which work together to extract and decrypt the core Snake Keylogger module (Tyrone.dll), which is hidden within a Bitmap resource.
The Deploy module initiates by renaming the Loader module and ensuring Snake Keylogger’s persistence through scheduled task creation, and then extracts and decrypts a resource containing the core Snake Keylogger module.
Employing process hollowing, the module creates a suspended process with the same name as the Loader module and injects the decrypted module into its memory space. After modifying the process’s context, it resumes execution, effectively concealing the original process and enabling Snake Keylogger’s malicious activities.
The Snake Keylogger core module, obfuscated to prevent analysis, is designed to collect sensitive information from the victim’s device, which gathers basic device details, saved credentials, keystrokes, screenshots, and clipboard data.
It fetches device information and checks against hardcoded IP addresses to avoid detection by automated analysis systems. If the victim’s IP matches a hardcoded address, credential collection continues but data is not sent to the attacker.
Snake Keylogger is malicious software that steals credentials from various software programs on a compromised system and collects data from web browsers, email clients, IM clients, and FTP clients.
The collected credentials are then sent to an attacker via SMTP, with the email body containing the victim’s computer information and stolen credentials by targeting a wide range of software, including popular web browsers like Chrome, Firefox, and Opera, as well as other applications such as Thunderbird, FileZilla, and Pidgin.
According to Fortinet, the Snake Keylogger campaign initiates with a phishing email that contains a malicious Excel document. Upon opening, the document exploits a vulnerability to download an HTA file, which subsequently leverages multiple scripts to download the Loader module.
It extracts various modules from the file’s Resource section and establishes persistence on the victim’s computer through process hollowing, and the core module then steals sensitive information and sends it to the attacker via SMTP.
.webp?w=1200&resize=1200,0&ssl=1 "IDA 9.0 Released: Exciting New Features in Reverse Engineering")
