Beware of phishing emails disguised as quote requests (SnakeKeylogger)

The AhnLab SEcurity intelligence Center (ASEC) recently confirmed that phishing emails disguised as requests for quotes are being circulated. The email body is disguised as a request from a representative of the Materials Management Division in the Purchasing Department asking the recipient to review a quote, and it prompts the recipient to download an attached compressed file for verification.
 

[Figure 1] Email Body

 

When a user downloads and decompresses the attached compressed file, a JavaScript file appears, as shown in [Figure 2]. This JavaScript file performs decryption and executes a PowerShell script embedded within it in an obfuscated form.

 

[Figure 2] Compressed File

[Figure 3] Malicious JavaScript

 

The executed PowerShell script decrypts the encrypted payload inside using the AES-256-CBC algorithm and executes it in memory. The payload that is decrypted and executed is also a PowerShell script.

 

[Figure 4] Secondary PowerShell script encrypted with AES-256-CBC

[Figure 5] AES-256-CBC decryption routine and secondary PowerShell script execution routine

 

The secondary PowerShell script executed in memory decrypts the internal payload using an XOR operation and then executes it in memory. During this process, it passes the path to “aspnet_compiler.exe”—the target of the process injection—and the final malware payload used for the injection as arguments.

XOR Key

• THeSaTaN56@@^

 

[Figure 6] Encrypted loader malware

[Figure 7] The path to `aspnet_compiler.exe` and the final malware payload passed as arguments

 

Once executed in memory, the loader malware launches the `aspnet_compiler.exe` process and then uses the process hollowing technique to inject the final malware payload into that process.

 

[Figure 8] Main section of the loader malware

 

The malware ultimately executed is SnakeKeylogger, an Infostealer type. SnakeKeylogger collects various types of information from the infected system—including data stored in web browsers, system information, and keylogging data—and transmits it externally through SMTP or Telegram. The C2 server information used in the attack is as follows.

SnakeKeylogger C2

• Mail Server: hosting2.ro.hostsailor[.]Com
• ID: logs@aewn[.]Buzz
• Email To: log@aewn[.]Buzz

 

[Figure 9] SnakeKeylogger malware Main

 

Response Guide

1. Verify the Sender

• Verify that the sender’s email address uses an official domain.

2. Check Hyperlinks and Attachments

• If the email body contains an image that prompts you to click on it, check the linked URL first before clicking. Suspicious URLs often lead through non-official paths before finally redirecting to a legitimate page, so you should examine them carefully. Additionally, if there are attachments, check for suspicious file extensions (.Exe, .Vbs, .Js, etc.).

3. Be Cautious When Entering Sensitive Information

• If you are asked to provide sensitive information, such as login credentials, always verify that the page’s URL corresponds to the official website before entering any information. If the page is not official, it is highly likely to be a suspicious URL, so caution is required. In particular, check the page’s security certification (HTTPS, padlock icon) before entering sensitive information, and never enter any information if you have any doubts.

MD5

e89c8668c8b5041768a59c1532edf2ad