July 2021’s Most Wanted Malware: Snake Keylogger Enters Top 10 for First Time

guest · Aug 12, 2021

July 2021’s Most Wanted Malware: Snake Keylogger Enters Top 10 for First Time
August 12, 2021
https://blog.checkpoint.com/2021/08...snake-keylogger-enters-top-10-for-first-time/

Our latest Global Threat Index for July 2021 has revealed that while Trickbot is still the most prevalent malware, Snake Keylogger, which was first detected in November 2020, has surged into second place following an intense phishing campaign.

Snake Keylogger is a modular .NET keylogger and credential stealer. Its primary function is to record users’ keystrokes on computers or mobile devices, and transmit the collected data to threat actors. In recent weeks, Snake has been growing fast via phishing emails with different themes across all countries and business sectors.
Click to expand...

Snake infections pose a major threat to users’ privacy and online safety, as the malware can steal virtually all kinds of sensitive information and it is a particularly evasive and persistent keylogger. There are currently underground hacking forums where the Snake Keylogger is available for purchase, ranging from 25 to 500 dollars depending on the level of service offered.

Keyloggers such as Snake, are often distributed via phishing emails so it’s essential that users know to look out for small discrepancies such as misspellings in links and email addresses and be educated to never click on suspicious links or open any unfamiliar attachments.
Click to expand...

Top malware families
This month, Trickbot is the most popular malware impacting 4% of organizations globally, followed by Snake Keylogger and XMRig, each with a global impact of 3%.
Top exploited vulnerabilities
This month “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 45% of organizations globally, followed by “HTTP Headers Remote Code Execution” which affects 44% of organizations worldwide. “MVPower DVR Remote Code Execution” is in third place in the top exploited vulnerabilities list, with a global impact of 42%.
Top mobile malwares
This month xHelper takes first place in the most prevalent Mobile malwares, followed by AlienBot and Hiddad.
Click to expand...

guest · Oct 29, 2021

Snake malware biting hard on 50 apps for only $25
October 29, 2021
https://www.bleepingcomputer.com/news/security/snake-malware-biting-hard-on-50-apps-for-only-25/

Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks.

Snake has been active since November 2020 and is a different project from the ransomware operation that used the same name in the past.
Written in .NET and using the same staging mechanism as FormBook and Agent Tesla, researchers from Cybereason take a deep dive into how the rising threat operates.
Click to expand...

Wide range of malicious features
Cybercriminals currently sell Snake on dark web forums for as low as $25, which could be why we see a spike in its deployment.
Mainly deployed in phishing campaigns, Snake installed via malicious email attachments or through drops sites reached by clicking on email links.

When installed on a computer, Snake is capable of stealing credentials from over 50 apps, including email clients, web browsers, and IM platforms.
Click to expand...

Evading detection
To avoid detection, Snake disables AV defenses by killing the associated processes and goes as far as to disable network traffic analyzers such as Wireshark.
Snake then adds itself to the exclusion list of the Windows Defender, allowing it to execute malicious PowerShell commands without being detected.

Finally, it is noteworthy that Snake gives its operators the versatility to choose what features they will activate on the malware during the packing stage.
This customization allows them to stay hidden by reducing the use of features in targeted attacks.
Click to expand...

Finally, when it comes to data exfiltration, Snake uses either an FTP or SMTP server connection or an HTTPS POST on a Telegram endpoint.
Click to expand...

Cybereason: THREAT ANALYSIS REPORT: Snake Infostealer Malware

KEY FINDINGS:

Serious threat to privacy and security: Snake is a feature-rich information-stealing malware. Snake has keystroke logging as well as clipboard data, screenshot, and credential theft capabilities. Snake can steal credentials from over 50 applications, which include File Transfer Protocol (FTP) clients, email clients, communication platforms, and web browsers. Snake can exfiltrate stolen data through a variety of protocols, such as FTP, Simple Mail Transfer Protocol (SMTP), and Telegram.

No industry or geographical preferences: Snake has been present in the threat landscape since November 2020 and has been a constant threat to users’ privacy and security since then. The Cybereason GSOC observed a spike in infections using the Snake malware in late August 2021 with no specific trend in the industry or the geographical locations of the targeted victims.

Click to expand...

guest · Sep 3, 2022

Snake Keylogger Returns with New Malspam Campaign Targeting IT Firms
by Waqas @WAK4S - September 1, 2022

Snake Keylogger is back in action with a brand new malspam campaign spreading via phishing emails sent to corporate IT enterprises’ managers. Bitdefender Antispam Labs discovered the campaign on 23 August 2022.

According to Bitdefender analysts, the IP addresses used in the attack originated from Vietnam, while the campaign’s primary targets were located in the USA, and thousands of inboxes have received the phishing email.
Click to expand...

Attackers leverage the corporate profile of one of Qatar’s leading IT and cloud services providers to trap victims into opening a ZIP archive. This archive has an executable file titled “CPMPANY PROFILE.exe.”

This file, according to Bitdefender’s blog post, loads the notorious Snake Keylogger payload on the targeted system’s host. The data is exfiltrated through SMTP.
Click to expand...

What is Snake Keylogger?
It is an infamous credential and info-stealing malware that exfiltrates sensitive data from infected machines. It has screenshot capturing and keyboard logging capabilities. It is a huge threat to enterprises because of its spying and data harvesting features.

In addition to that, it can steal information from system clipboards. It is also called 404 Keylogger. The trojan surfaced in 2020 and is currently available at underground marketplaces/message boards for a few hundred dollars. The malware is used commonly in financially motivated campaigns, including identity theft and fraud-based campaigns.
Click to expand...

Bitdefender: Snake Keylogger Returns in Malspam Campaign Disguised as Business Portfolio from IT Vendor

by Alina BÎZGĂ - August 30, 2022
Snake Keylogger has slithered its way back into the threat landscape this week in a new malspam campaign that appears to be targeting IT decision makers within organizations.
Click to expand...

Log in or Sign up

July 2021’s Most Wanted Malware: Snake Keylogger Enters Top 10 for First Time

guest Guest

guest Guest

guest Guest

Log in or Sign up

July 2021’s Most Wanted Malware: Snake Keylogger Enters Top 10 for First Time

guest Guest

guest Guest

guest Guest

Useful Searches