Snake Malware Biting Hard on 50 Apps For Only $25

Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks.

Snake has been active since November 2020 and is a different project from the ransomware operation that used the same name in the past.

Written in .NET and using the same staging mechanism as FormBook and Agent Tesla, researchers from Cybereason take a deep dive into how the rising threat operates.

Also Read: What Is Data Sovereignty and How Does It Apply To Your Business?

Wide range of malicious features

Cybercriminals currently sell Snake on dark web forums for as low as $25, which could be why we see a spike in its deployment.

Mainly deployed in phishing campaigns, Snake installed via malicious email attachments or through drops sites reached by clicking on email links.

When installed on a computer, Snake is capable of stealing credentials from over 50 apps, including email clients, web browsers, and IM platforms.

Some of the more popular programs targeted by Snake include:

• Discord
• Pidgin
• FileZilla
• Thunderbird
• Outlook
• Brave browser
• Chrome
• Edge
• Firefox
• Opera
• Vivaldi
• Yandex

Snake also features keystroke logging, clipboard data theft capabilities and can even capture screenshots of the entire screen, which are then uploaded back to the threat actor.

Also Read: What Vulnerability Assessment Shows and How It Can Save You Money

Other features include stealing OS data, memory space info, geolocation, date-time information, IP addresses, and more.

A previous analysis from HP has shown that threat actors may use the geolocation data to restrict installation based on the victim’s country.

All in all, it’s a versatile info-stealer for its cost and has been successful at hiding from security solutions.

Evading detection

To avoid detection, Snake disables AV defenses by killing the associated processes and goes as far as to disable network traffic analyzers such as Wireshark.

Snake then adds itself to the exclusion list of the Windows Defender, allowing it to execute malicious PowerShell commands without being detected.

Snake adds a scheduled task and edits a registry key to execute when a user logs in to Windows to establish persistence.

Finally, it is noteworthy that Snake gives its operators the versatility to choose what features they will activate on the malware during the packing stage.

This customization allows them to stay hidden by reducing the use of features in targeted attacks.

Finally, when it comes to data exfiltration, Snake uses either an FTP or SMTP server connection or an HTTPS POST on a Telegram endpoint.