Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

Snake Malware Biting Hard on 50 Apps For Only $25

Snake Malware Biting Hard on 50 Apps For Only $25

Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks.

Snake has been active since November 2020 and is a different project from the ransomware operation that used the same name in the past.

Written in .NET and using the same staging mechanism as FormBook and Agent Tesla, researchers from Cybereason take a deep dive into how the rising threat operates.

Also Read: What Is Data Sovereignty and How Does It Apply To Your Business?

Wide range of malicious features

Cybercriminals currently sell Snake on dark web forums for as low as $25, which could be why we see a spike in its deployment.

Mainly deployed in phishing campaigns, Snake installed via malicious email attachments or through drops sites reached by clicking on email links.

When installed on a computer, Snake is capable of stealing credentials from over 50 apps, including email clients, web browsers, and IM platforms.

Some of the more popular programs targeted by Snake include:

  • Discord
  • Pidgin
  • FileZilla
  • Thunderbird
  • Outlook
  • Brave browser
  • Chrome
  • Edge
  • Firefox
  • Opera
  • Vivaldi
  • Yandex

Snake also features keystroke logging, clipboard data theft capabilities and can even capture screenshots of the entire screen, which are then uploaded back to the threat actor.

Also Read: What a Vulnerability Assessment Shows and How It Can Save You Money

Snake's stealing capability diagram
Snake’s stealing capability diagram
Source: Cybereason

Other features include stealing OS data, memory space info, geolocation, date-time information, IP addresses, and more.

A previous analysis from HP has shown that threat actors may use the geolocation data to restrict installation based on the victim’s country.

All in all, it’s a versatile info-stealer for its cost and has been successful at hiding from security solutions.

Evading detection

To avoid detection, Snake disables AV defenses by killing the associated processes and goes as far as to disable network traffic analyzers such as Wireshark.

Snake then adds itself to the exclusion list of the Windows Defender, allowing it to execute malicious PowerShell commands without being detected.

Snake adds a scheduled task and edits a registry key to execute when a user logs in to Windows to establish persistence.

Finally, it is noteworthy that Snake gives its operators the versatility to choose what features they will activate on the malware during the packing stage.

This customization allows them to stay hidden by reducing the use of features in targeted attacks.

Finally, when it comes to data exfiltration, Snake uses either an FTP or SMTP server connection or an HTTPS POST on a Telegram endpoint.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us