{"id":2864,"date":"2025-06-27T12:54:52","date_gmt":"2025-06-27T10:54:52","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=2864"},"modified":"2025-06-27T13:40:38","modified_gmt":"2025-06-27T11:40:38","slug":"snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations\/","title":{"rendered":"Snake Keylogger in Geopolitical Affairs: Abuse of Trusted Java Utilities in Cybercrime Operations"},"content":{"rendered":"\n

The S2 Group’s intelligence team has identified through adversary tracking a new phishing campaign by Snake Keylogger, a Russian origin stealer programmed in .NET, targeting various types of victims, such as companies, governments or individuals.<\/p>\n\n\n\n

The campaign has been identified as using spearphishing emails offering oil products. These emails will contain a zipped attachment that uses the legitimate jsadebugd.exe binary and the Sideloading Dll technique to load Snake Keylogger into the legitimate InstallUtil.exe binary. jsadebugd is a legitimate Java utility used for debugging processes. However, its malicious use has recently been observed, something that has not been documented before.<\/p>\n\n\n\n

Snake Keylogger is distributed via a Malware-as-a-service (MaaS) model, previously used by different groups against different targets. One example is its use in campaigns against Ukraine by UAC-00411<\/a><\/sup> or TA558.2<\/a><\/sup><\/p>\n\n\n\n

The increase in geopolitical tensions in the Middle East, with the conflict between Iran and Israel and the recent US involvement, could have a direct and global impact on logistics and oil prices.<\/p>\n\n\n\n

This element could be used within social engineering phishing as has been detected in this case. This could be an indicator that the target of the campaign could be against organisations in the oil sector. On the other hand, they could exploit this theme due to the growing fear that is being generated in the Middle East regarding the possible increase in the price of oil and possible logistical problems in the event of a hypothetical closure of the Strait of Hormuz. <\/p>\n\n\n\n

Within the body of the email it can be seen that it is intended to impersonate one of Kazakhstan’s main oil companies: LLP KSK PETROLEUM LTD OIL AND GAS. Kazakhstan is one of the largest oil producers in Central Asia and a major gas producer.2<\/a><\/sup><\/p>\n\n\n\n

Analysis<\/h1>\n\n\n\n

The campaign will use spearphishing emails offering oil products with a malicious attachment containing a zipped file.<\/p>\n\n\n

\n
\"\"
Example of spearphishing mail used<\/figcaption><\/figure><\/div>\n\n\n

This archive will contain a number of binaries, including the legitimate executable jsadebugd.exe vulnerable to the Sideloading Dll technique which will have been renamed to \u2018001 PETROLEUMLTD LLP KSK SCO 1 ORIGINAL (1).exe\u2019. When executed by the user this executable will load the malicious DLL jli.dll.<\/p>\n\n\n

\n
\"\"
Contents of the compressed file<\/figcaption><\/figure><\/div>\n\n\n

The Snake Keylogger binary will be stored inside the file \u2018concrt141.dll\u2019. To evade detection by security tools, binary data will have been added to the beginning of the file, just before the MZ header.<\/p>\n\n\n

\n
\"\"
Binary code added at the beginning of the executable<\/figcaption><\/figure><\/div>\n\n\n

This binary will be injected into the legitimate InstallUtil.exe<\/strong> process. As a form of persistence, the contents of the compressed file will be copied to the folder “%USERPROFILE%\\SystemRootDoc”.<\/strong> The persistence key “SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\001 PETROLEUMLTD LLP KSK SCO 1 ORIGINAL (1)”<\/strong> will then be created with the command “cmd.exe \/C start “” \/D “%USERPROFILE%\\SystemRootDoc” “%USERPROFILE%\\SystemRootDoc\\001 PETROLEUMLTD LLP KSK SCO 1 ORIGINAL (1).exe”.<\/strong><\/p>\n\n\n

\n
\"\"
Registry key creation<\/figcaption><\/figure><\/div>\n\n\n

The SnakeLogger malware will send the IP of the computer along with the country of origin using legitimate websites such as reallyfreegeoip.org<\/strong> and checkip.dyndns.org.<\/strong><\/p>\n\n\n

\n
\"\"
Information exfiltrated by the malware<\/figcaption><\/figure><\/div>\n\n\n

Snake Keylogger will also exfiltrate passwords from various applications and browsers.<\/p>\n\n\n

\n
\"\"
Browser and application credentials collected<\/figcaption><\/figure><\/div>\n\n\n

Below is the complete list of browsers from which data was collected by the sample.<\/p>\n\n\n\n