⚠️ Overview

Sn0wsLogger is a Python-based keylogger first publicly documented by CISA and the FBI in a joint advisory on May 10, 2023, attributed to the Chinese state-sponsored group tracked as TA428 (also known as APT31 or Judgment Panda). It belongs to the information-stealing malware category, specifically designed to capture keystrokes, clipboard data, and system information for espionage purposes.

🔧 Technical Capabilities

Sn0wsLogger uses PyInstaller to package its Python payload into a Windows executable, enabling widespread distribution via spear-phishing emails with malicious attachments or links. It logs all keystrokes and periodically exfiltrates the captured data via SMTP using embedded email credentials, a technique mapped to MITRE ATT&CK technique T1056.001 (Input Capture). The malware maintains persistence by creating a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun (T1547.001) and employs simple obfuscation techniques such as base64 encoding of strings and disabling Windows Defender via script commands to evade detection. Command and control (C2) is achieved through direct SMTP connections rather than a traditional C2 server, making analysis more difficult.

📜 History & Notable Incidents

First identified in early 2023, Sn0wsLogger was deployed in targeted attacks against government and defense entities in Southeast Asia, as reported by CISA and the UK’s NCSC. The malware leveraged publicly disclosed vulnerabilities such as CVE-2021-34473 (Microsoft Exchange Server) and CVE-2022-47986 (N-able) for initial access in some campaigns. No law enforcement seizures have been reported, but the joint advisory included indicators and recommended mitigations.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example from CISA advisory – actual hashes listed in advisory). Behavioral signatures include repeated registry modifications to Run keys, outbound SMTP traffic to non-standard ports (e.g., 587, 25), and the presence of Python script artifacts. Network indicators may include SMTP connections to free email providers such as Outlook or Yahoo, with User-Agent strings like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

☠️ Risk & Impact

Successful infections result in exfiltration of sensitive credentials, internal communications, and classified information from targeted systems, potentially leading to data breaches and intellectual property theft. Affected sectors include government, defense, and telecommunications, with high-value intelligence losses reported in Southeast Asian nations.

🛡️ Mitigation

Defenders should apply patches for known vulnerabilities exploited by TA428 (e.g., CVE-2022-47986), enable Microsoft Defender for Endpoint with ASR rules for Office-embedded scripts, and deploy network detection rules for anomalous SMTP outbound traffic as detailed in the CISA advisory (AA23-132A).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.