A sophisticated malware campaign, known as SnakeKeylogger, has been identified as a significant threat to both individuals and businesses.
This multistage info-stealer malware is designed to harvest sensitive data, including login credentials, while evading detection through stealthy in-memory execution and obfuscated techniques.
Infection Vector and Attack Chain
The initial infection vector for SnakeKeylogger involves malicious spam emails containing .img files as attachments.
Once opened, these files create a virtual drive that houses an executable masquerading as a PDF document.
According to Seqrite Blog, this executable, known as Stage1, is a small .NET compiled file that connects to a remote server to fetch encoded payloads disguised as media files.
The payloads are decrypted in memory, avoiding disk-based detection, and then used to load obfuscated DLLs directly into memory.
This approach allows the malware to bypass traditional security measures by not writing any malicious code to the disk.
Technical Analysis and Malware Behavior
In the second stage of the attack, a 32-bit DLL named Xspilbxpui.dll is dynamically loaded into memory.
This DLL is highly obfuscated and employs process hollowing to execute its payload stealthily by targeting legitimate Windows utilities like InstallUtil.exe.
The injected payload is a variant of SnakeKeylogger, which focuses on stealing system data, including Wi-Fi connection details and credentials from various applications.
It targets web browsers, email clients, and FTP clients to extract stored login data.
For instance, it accesses Microsoft Outlook profiles to extract email account details and server settings, which can be used to bypass multi-factor authentication or launch further attacks.
The SnakeKeylogger campaign highlights the evolving sophistication of info-stealer malware.
Its ability to maintain a stable infrastructure for hosting and updating encrypted payloads allows attackers to adapt quickly to security measures.
The malware’s primary goal is to collect sensitive data that can be exploited for business email compromise, further intrusions, or sold on the dark web.
To mitigate these threats, users should be cautious with email attachments and ensure their systems are updated with the latest security patches.
Additionally, employing robust antivirus software and educating users about phishing tactics can significantly reduce the risk of infection.
Find this Story Interesting! Follow us on LinkedIn, and X to Get More Instant Updates
