[February | Malware Analysis Report] SnakeKeylogger Malware Targeting Defense and Aerospace Companies

The SANDS Lab Threat Analysis Team selects malware each month and prepares a report.

Through expert analysis, we share malware characteristics, threat trends, and related intelligence to help create a safer cyber environment.

More detailed information on malware is available through our cyber threat intelligence service, <CTX>.

1. Overview

This report analyzes infostealer malware distributed using work-related file names.

The malware uses contract-related file names such as “견적 요청 건.cmd” to entice users to execute it, then steals user account information, credit card details, cookies, and autofill data from infected systems.

Using social engineering to masquerade as a work-related file, the malware employs multistage execution and detection-evasion techniques. In particular, it uses process hollowing to inject malicious code into a legitimate process, evading detection and complicating analysis. It also includes specific open-source libraries to appear legitimate, and functionality that detects security research environments and restricts its behavior.

In a similar case in Türkiye, a Snake Keylogger variant was reportedly distributed through malicious emails disguised as contract documents. Like the malware analyzed here, it is an infostealer distributed by email, with functions to collect sensitive data such as account information, cookies, and credit card details from browsers and email clients. These similarities suggest that the malware analyzed in this report was also likely distributed through email.

Some functions in the analyzed version were found to be incomplete. However, the code contains capabilities that could be activated in the future, including disabling security solutions, keylogging, and downloading additional malware. This report examines the malware’s operation, detection-evasion strategies, and potential future threats.

2. Malware Information

Infostealer malware distributed against targets in South Korea was identified on the SANDS Lab CTX platform.

The malware attempts to evade detection by obfuscating method names and API call keys. This obscures its structure and intent, helping it bypass security detection and increasing analysis time.

[Figure 1] Infostealer malware targeting South Korea identified in SANDS Lab CTX

The malware is distributed under the file name “견적 요청 건.cmd” to entice victims to run it, after which “Fuzio.exe” executes. An unfinished UI window titled “Form1” appears, with no further malicious activity visible on the surface. This appears designed to keep users from realizing that malware is running.

[Figure 2] Execution screen of 견적 요청 건.cmd

In the background, it collects sensitive information such as user account details and data saved by websites, with functions to send it to the attacker via Telegram, Discord, and web panels. However, the Telegram token and ID settings are empty, preventing actual transmission, and many methods in the code are unimplemented. These findings indicate that the malware is still incomplete.

The malware stores obfuscated data in resource files and decrypts it at runtime for use as malicious payloads. It uses process hollowing to conceal the process carrying out malicious activity and incorporates open-source libraries such as dnSpy¹ and DarkUI² to complicate analysis. Namespaces associated with dnSpy and DarkUI were found in Fuzio.exe and Example.dll, apparently intended to disguise the malware as a legitimate open-source project and conceal its core functions. This approach makes the malware look like normal software, helping evade security detection and hide its real purpose.

¹ dnSpy: A tool for decompiling and debugging .NET binaries

² DarkUI: A library providing UI elements

[Figure 3] DarkUI library components (right) included in namespaces within Example.dll (left)

In summary, this infostealer combines social engineering and obfuscation to carry out malicious activity and employs strategies to delay analysis. Its current incomplete state limits the threat, but implementing additional functions could make account theft and sensitive data collection a serious risk.

3. Malware Execution Flow

When the victim executes “견적 요청 건.cmd,” Fuzio.exe runs internally.

This executable decrypts the embedded Example resource, loads the resulting data into memory, and executes a specific class.

Example.dll then decrypts its embedded AQipUvwTwkLZyiCs resource and executes a specific internal class. This class creates an identical child process and injects Remington.exe into it using process hollowing. The malware thereby masquerades as a legitimate process to evade detection and conceal malicious activity.

The final payload, Remington.exe, is the core malware that collects sensitive information from infected systems, including browser login credentials, cookies, credit card details, autofill data, and download history. Its code supports exfiltration through FTP, email (SMTP), Discord, Telegram, C2 servers, and C2 web panels. However, only email transmission using SMTP is currently enabled, and the covid19support.top and 51.38.27.67:8081 servers previously used to transmit the data were found to be inactive.

[Figure 4] Malware execution flow

4. Malware Analysis

4.1. Fuzio.exe

4.1.1. Overall Functionality

[Figure 5] Fuzio.exe file information

At runtime, Fuzio.exe decrypts the embedded Example resource and executes a specific class.

A form named “Form1,” measuring 800 x 450, appears when the program runs and seems unfinished. This likely aims to make users perceive the program as legitimate software and overlook its malicious activity.

[Figure 6] Form initialization code

4.1.2. Detailed Code Analysis

Fuzio.exe first extracts its embedded Example resource, converts it to a byte array, and decrypts it using the attacker-created SYYM() function. It loads the decrypted data as an assembly, enumerates public types in metadata-token order, and returns the 36th public type to execute a specific class.

[Figure 7] Main code returning the 36th public type in Example

[Figure 8] Code returning public types after loading the assembly

Analysis identified the decrypted Example data as Example.dll. The 36th public type in that DLL is the UOBBssQLTBnTDUiGUyhCkhxiCLfOhJwhGkJTyTOxQQnJnDDhTsi class.

4.2. Example.dll

4.2.1. Overall Functionality

[Figure 9] Example.dll file information

The UOBBssQLTBnTDUiGUyhCkhxiCLfOhJwhGkJTyTOxQQnJnDDhTsi class in Example.dll decrypts the embedded AQipUvwTwkLZyiCs resource. The decrypted data is loaded as a file, then the ShopyBy() method in its vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE class is called. This method receives two arguments and uses them to perform its function.

[Figure 10] Code for the UOBBssQLTBnTDUiGUyhCkhxiCLfOhJwhGkJTyTOxQQnJnDDhTsi class

4.2.2. Detailed Code Analysis

Example.dll decrypts the embedded AQipUvwTwkLZyiCs resource and converts it to a byte array. The data is loaded as an assembly through Thread.Get Domain().Load(), and the vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE class type in the assembly’s fQTxvsCvCTEnwspAkDAivZUsnQiOyvnxpsAhvwBkvJGZMZ namespace is referenced. It locates ShopyBy() in the loaded class and executes it using Invoke(), passing two arguments with the following roles.

1. First argument: Data obtained by decrypting the Scrivens resource and converting it to a byte array

2. Second argument: The path of the currently running executable, namely <실행 경로>\Fuzio.exe

[Figure 11] Code returning the result of ShopyBy()

Analysis identified the decrypted contents of each embedded resource as follows.

4.3. AQipUvwTwkLZyiCs.dll

4.3.1. Overall Functionality

[Figure 12] AQipUvwTwkLZyiCs.dll file information

AQipUvwTwkLZyiCs.dll performs process hollowing through ShopyBy(), injecting malware into a running process. It creates a new process in a suspended state, manipulates its memory, and injects the Scrivens file (Remington.exe). The new process is ultimately replaced completely, allowing Remington.exe to execute malicious activity.

4.3.2. Detailed Code Analysis

HandleRun() performs process hollowing to evade security software detection, enabling covert information theft and malicious activity on the infected system.

[Figure 13] ShopyBy() code

The method operates in the following sequence.

① Initialization and process creation

HandleRun() stores the executable path as a string and initializes the STARTUP_INFORMATION and PROCESS_INFORMATION structures. It then calls CreateProcess() to create a new process of the currently running EXE with the CREATE_SUS PENDED flag, keeping it suspended so its memory can be manipulated before execution.

[Figure 14] Initialization and process creation code

② Preparing to manipulate the memory context

Depending on the system environment, it calls GetThreadContext() or Wow64GetThreadContext() to obtain the new process’s execution context. Context information, including key register values, is stored in the array array.

[Figure 15] Code preparing memory context manipulation

③ Calculating the PE header offset

It calculates the PE header offset of the Scrivens file by reading data relative to the PE signature and analyzing the header. It extracts the base address and section information and calculates additional offsets. This is essential to map memory correctly according to the PE structure.

[Figure 16] PE header offset calculation code

④ Checking image base addresses and allocating memory

It compares the image base addresses of the original executable and the Scrivens file for conflicts. If they conflict, it unmaps the existing process memory and calls VirtualAllocEx() to allocate new memory for Scrivens. If allocation fails, it tries another address or raises an exception to terminate the process.

[Figure 17] Image base address checking and memory allocation code

⑤ Injecting malicious code

It copies the Scrivens file into the allocated memory using WriteProcessMemory(). It analyzes the headers and section data and loads each section at the appropriate memory address. In particular, VirtualAddress and PointerToRawData information is used to construct the memory map correctly and prepare Scrivens for execution.

[Figure 18] Scrivens data injection code

⑥ Updating the entry point

It calculates the EntryPoint address of Scrivens and updates the new process’s execution context accordingly. SetThreadContext() or Wow64SetThreadContext() changes the process’s execution point to the Scrivens EntryPoint. Once complete, the process is configured to execute the Scrivens code.

[Figure 19] Entry point update code

⑦ Resuming the process

After preparation is complete, ResumeThread() resumes the suspended process. From this point, Scrivens (Remington.exe) runs instead of the original executable and performs malicious activity on the infected system. Although the originally launched file appears legitimate, completely replaced code is executing internally.

[Figure 20] Process resumption code

4.4. Remington.exe

4.4.1. Overall Functionality

[Figure 21] Remington.exe information

Remington.exe is the core module responsible for stealing sensitive data from infected systems and transmitting it externally. It uses the COVID19 namespace internally and is designed to collect user account information, website cookies, credit card details, browsing history, and download history.

It uses anti-analysis techniques to inspect its execution environment and restrict data theft and transmission on specific networks. Although it is designed to exfiltrate data via FTP, email (SMTP), Discord, Telegram, C2 servers, and C2 web panels, only SMTP was found to be enabled.

It also includes functions to look up the public IP address and country and send messages through the Telegram API. However, the Telegram function is inactive because its API token is empty. The malware attempts to communicate with covid19support.top, but that server was found to be offline.

4.4.2. Detailed Code Analysis

The COVID19 namespace within Remington.exe defines 319 methods, of which 26 are merely declared and have no implemented functionality.

[Figure 22] Excerpt of COVID19.Main() code

ClickTracker() calls TelegramMSG() to send messages using the Telegram API. It invokes the API’s sendMessage endpoint to deliver messages through HTTP requests.

[Figure 23] ClickTracker method code

[Figure 24] Telegram API message-sending URL

[Figure 25] TelegramMSG method code

The token and chat ID used by this function were obfuscated, but decryption produced empty values. The function may therefore not yet be enabled, or the attacker may have used it only for testing.

[Figure 26] Token decryption result

[Figure 27] Decoding Telegram communication

The malware also includes functionality to identify the infected PC’s public IP address and country.

It calls specific APIs to retrieve the victim’s network information for further analysis.

- checkup.dyndns.org -> Looks up the infected PC’s public IP address

- reallyfreegeoip.org -> Requests country information based on the retrieved IP address

[Figure 28] ClickINFO variable declaration code

[Figure 29] TheCountryNameInfo() code

[Figure 30] IPLogger() code

These functions allow the attacker to analyze the victim’s network environment and determine whether the system belongs to a particular country or organization.

The following network communication was observed when the file was executed.

[Figure 31] Network communication during execution

[Figure 32] Communication with the reallyfreegeoip API

Remington.exe steals sensitive information from infected systems and is designed to collect a range of user data stored in browsers and the system. Its main information-stealing functions are listed below.

[Table 1] Information stolen by each method

[Figure 33] Information-stealing method code

AntiBotStart() checks the execution environment to determine whether the malware should operate. It first calls AntiBot() to check for specific network environments and disables data theft when running from particular IP addresses.

[Figure 34] Excerpt of AntiBotStart() code

[Figure 35] AntiBot() code

Among the IP addresses in the code, 141.226.236.91 is associated with a cybersecurity research institution at Israel’s Ben-Gurion University of the Negv, and 3.23.155.57 was identified as being used by an AWS-hosted CAPE Sandbox analysis environment. These addresses appear to belong to cybersecurity research and malware analysis infrastructure. The attacker likely excluded these environments to prevent detection and analysis.

[Figure 36] 141.226.236.91

[Figure 37] 3.23.155.57:8000

No public information was found for 89.208.29.130 or 69.55.5.249, but these may be attacker-operated test environments or IP addresses associated with particular organizations. These settings may restrict the malware to selected environments and suggest that the attacker performed internal testing before distribution.

Taken together, these findings indicate that AntiBotStart() restricts malicious activity in specific security research environments and analysis systems. This environment-based execution control appears to be a strategy for obstructing researchers’ analysis and evading malware detection.

The malware is also designed to transmit user data to the attacker through a total of 6 methods: FTP, email (SMTP), Discord, Telegram, a C2 server, and a C2 web panel.

[Table 2] Transmission methods and attacker information

[Figure 38] Excerpt of stolen-data transmission code

Only email (SMTP) transmission is currently enabled. The attacker appears to have exfiltrated data using the following accounts.

- Sender email: logs4@covid19support.top

- Recipient email: log4@covid19support.top

- SMTP port: 587

- SMTP password: 7213575aceACE@@

The attacker’s covid19support.top domain and C2 server (51.38.247.67:8081) were also found to be inactive.

An attempt to access covid19support.top returned “ERR_CONNECTION_REFUSED,” confirming that normal access was unavailable. Its IP address resolved to 91.195.240.12. Further analysis indicated that more than approximately 2.6 million domains are managed through the Germany-based domain parking service. The attacker likely activated the domain only at particular times to distribute malware, then abandoned it or established new infrastructure to evade blocking.

[Figure 39] Result of accessing covid19support.top

[Figure 40] IP address lookup for covid19support.top

[Figure 41] Information lookup for 91.195.240.12

The C2 server at 51.38.247.67:8081 also did not respond, returning no information on port 8081. This suggests that the attacker took the server down or configured it to activate only under specific conditions.

IP analysis identified 51.38.247.67 as allocated by OVH SAS, a France-based cloud provider. The attacker is believed to have provisioned a Windows Server VPS (Virtual Private Server) on OVH Cloud and operated it as a C2 server. Overall, the attacker may have used OVH SAS cloud services to host the C2 server, then taken it down to avoid blocking or restricted access to particular network environments.

[Figure 42] Connection attempt to 51.38.247.67:8081

[Figure 43] Information lookup for 51.38.247.67

4.4.3. Unimplemented Malicious Functions

Remington.exe contains numerous methods that are declared but not implemented. Although these do not currently execute, analysis of functions likely to be activated in future updates identified the following potential malicious behavior.

① Analysis evasion and self-protection

# AntiVm(), AntiSandboxie(), SelfHidden(), MeltMele()

- Could detect virtual machines (VMs) and sandbox environments to prevent analysis and hide the malware’s presence

# SelfDestruct()

- Could delete its own file to remove traces of infection, potentially hindering analysis and evading detection

② Disabling security features and blocking user control

# DisableWD(), Restores_Disabler(), Taskmgr_Disabler(), CMD_Disabler(), Registeries_Disabler()

- Could disable security software (Windows Defender) and system restore, while blocking access to Task Manager, the command prompt (CMD), and the registry editor (Registries) to limit user control

③ Information theft and monitoring

# StartKeylogger(), KeyLogger()

- Keylogging could be abused to steal login credentials, financial information, and email credentials

# TakeScreenshot()

- Could capture the victim’s screen and send it to the attacker

# OutlookContact(), FoxmailCustomContact()

- Could collect contacts stored in email clients (Outlook and Foxmail) for phishing or spam campaigns

④ Additional malicious activity

# DownloaderFile(), ProcessKiller(), Browser_Killer()

- Could download and execute additional malware from remote servers or terminate specific processes to forcibly close security software and browsers

# CookiesEraser()

- Could delete browser login sessions and saved cookies to force reauthentication, potentially allowing the attacker to steal fresh credentials

These functions are currently only declared and remain inactive, but some are likely to be enabled if development continues. Implementing security-disabling and anti-analysis features would strengthen detection evasion, while enabling keylogging and screenshots could lead to theft of financial information and confidential corporate data.

5. Conclusion

The malware analyzed in this report is an infostealer that steals account information, browser data, and credit card details from infected systems. CTX APT Intelligence analysis found evidence of distribution in Australia, Hungary, and Germany as well as South Korea.

This suggests that it may be part of a broad campaign targeting multiple countries rather than a single-country targeted attack.

CTX classified the analyzed malware as SnakeKeylogger and identified a link to the covid19support.top domain.

SnakeKeylogger is a .NET-based infostealer characterized by data exfiltration over email (SMTP), FTP, or Telegram and keylogging capabilities. The analyzed malware implements the same exfiltration methods, including transmission to the attacker’s mail server over SMTP. However, its keylogging-related code is only declared and does not operate. These findings suggest it is likely a SnakeKeylogger variant, potentially derived from the original with some features removed or changed. The attacker could still enable keylogging in the future.

[Figure 44] Related campaign information identified in SANDS Lab CTX

In a similar incident in Türkiye, a Snake Keylogger variant was distributed through malicious emails impersonating TUSAŞ (Turkish Aerospace Industries). Disguised as contract documents, it deceives victims and collects account information, browser cookies, and financial information from infected systems. The analyzed malware has similar code structure and information-stealing functions, suggesting email was likely its primary distribution channel.

It also uses process hollowing to inject malicious code into legitimate processes, evading detection and making analysis more difficult. Specific open-source libraries help it appear legitimate, while environment-detection functions restrict its behavior in security research settings.

Although the analyzed version is incomplete, its code contains functions such as security-disabling and keylogging that may be activated in the future. Further updates or new variants would therefore have more sophisticated information-stealing and detection-evasion capabilities.

6. Collected / Exfiltrated Information

​

7. IoC Information

7.1. SHA256 Hashes

- Fuzio.exe/A42ED71F0E79BD1C7A9DEA80898016D199F6486455A44929927B2A356C4499F8

- Example.dll/33dc029cf1a2924dd1e6940e978ec7dc8ba3c3c71cb0611c38095e8097969b5d

- AQipUvwTwkLZyiCs.dll/9c3a7120e337a34b946fc969993c492cec20d3e185c8775b0d4d44cb492d54db

- Remington.exe/bc89907782e3bd88e95b84fdcbd658e5a9bb70b567cf52538d44fd86911e3ab6

7.2. IP

- AntiBot(): 89.208.29.130 / 69.55.5.249 / 141.226.236.91 / 3.23.155.57

- C2 server: 51.38.247.67

- covid19support.top: 91.195.240.12

7.3. Domains

- mail.covid19support.top

- covid19support.top

- api.Telegram.org

- checkip.dyndns.org

- reallyfreegeoip.org

7.4. URL

- hxxp://mail.covid19support.top

- http://api.Telegram.org/bot<token>/sendMessage?chat_id=<chat_id>%text=<msg>

- hxxp://checkip.dyndns.org

- hxxps://51.38.247.67:8081

- hxxp://reallyfreegeoip.org/xml/<IP>

8. References

- https://www.ctx.io/report/file/a42ed71f0e79bd1c7a9dea80898016d199f6486455a44929927b2a356c4499f8

- https://github.com/dnSpy/dnSpy/tree/master/dnSpy

- https://github.com/RobinPerris/DarkUI

- https://www.malwation.com/blog/technical-analysis-of-phishing-campaigns-targeting-the-defense-industry-delivering-snake-keylogger