Snake Keylogger Variant Will Steal All The Sensitive Data

A Persistent Information Stealer Targeting Windows Users

Another emerged variant of Snake Keylogger has been detected actively targeting Windows users in multiple regions, including China, Turkey, Indonesia, Taiwan, and Spain. Reports indicate that this version has already triggered over 280 million blocked infection attempts globally since the start of the year. Its primary objective is to capture sensitive user data, particularly login credentials, by logging keystrokes, monitoring clipboard activity, and extracting information from widely used web browsers such as Chrome, Edge, and Firefox.

How Snake Keylogger Gains Access to Devices

The primary method of distribution for this keylogger is through deceptive emails carrying malicious links or attachments. Once executed, the malicious software embeds itself deep within the system to collect and transmit stolen data. This is achieved by leveraging the Simple Mail Transfer Protocol (SMTP) and Telegram bots, enabling attackers to retrieve the compromised information remotely.

A distinguishing feature of this latest wave of attacks is the use of the AutoIt scripting language. By embedding its payload within an AutoIt-compiled binary, this technique enables the malicious software to avoid traditional detection tools, making it more difficult for security systems to identify the threat. Additionally, AutoIt introduces dynamic behaviors that closely resemble legitimate automation tools, further complicating its detection.

Establishing Persistence on the System

Once installed, Snake Keylogger ensures its persistence by copying itself as a file named "ageless.exe" within the "%Local_AppData%\supergroup" directory. Furthermore, it places a secondary file called "ageless.vbs" in the Windows Startup folder, which ensures that the malware reloads every time the system is restarted. This method allows the keylogger to continue its operations even if the initial process is halted or removed.

To further conceal its presence, Snake Keylogger injects its core payload into a legitimate .NET process, such as "regsvcs.exe." This technique, known as process hollowing, enables malicious software to operate within a trusted system process, making it more challenging for security solutions to detect and eliminate the threat.

The Implications of Snake Keylogger’s Activities

Once successfully embedded in a system, Snake Keylogger captures keystrokes using a specialized technique that involves the SetWindowsHookEx API. Setting the first parameter to WH_KEYBOARD_LL (flag 13) enables low-level keyboard monitoring. This allows attackers to log sensitive user input, including banking credentials, passwords, and private messages.

Beyond recording keystrokes, the keylogger also accesses web services like checkip.dyndns.org to determine the geographic location and IP address of the compromised system. This data could be used for further targeting or to enhance other malicious campaigns based on the victim's location.

Similar Threats Leveraging Deceptive Techniques

The emergence of this Snake Keylogger variant aligns with broader cybercrime trends where malicious actors exploit advanced scripting techniques to evade detection. Recent investigations have also uncovered separate campaigns that distribute stealer threats using shortcut (LNK) files disguised as PDF documents. These LNK files, hosted on compromised educational institution infrastructure, execute PowerShell commands to download and install additional threats.

Another related technique involves using obfuscated JavaScript files to deploy similar threats. These scripts retrieve encoded strings from open-source services, ultimately leading to the execution of PowerShell commands that download harmful payloads. Some of these payloads have been embedded in seemingly innocuous image files using steganographic methods, making them even harder to detect.

Mitigating the Risks Associated with Snake Keylogger

Given the sophisticated nature of this keylogger and its evasion techniques, users should exercise caution when handling unsolicited emails or attachments. Organizations should implement advanced email filtering to block suspicious messages before they reach employees. Additionally, endpoint security solutions should be updated regularly to recognize new evasion strategies used by these threats.

As attackers continue refining their methods, cybersecurity awareness remains a critical defense. Understanding how deceptive techniques work and maintaining vigilance while browsing the internet or accessing emails can significantly reduce the risk of such threats. By staying informed and adopting proactive security measures, individuals and businesses can better safeguard their sensitive information against evolving digital dangers.