⚠️ Overview

SnakeDisk is a Python-based information stealer first documented by researchers at Trend Micro in November 2023 as part of a campaign targeting Latin American financial institutions, classified under the stealer/trojan category. It is believed to be operated by a Spanish-speaking threat actor group tracked as TA524, with initial delivery via phishing emails containing malicious ZIP attachments masquerading as invoices.

🔧 Technical Capabilities

SnakeDisk propagates through spear-phishing with weaponized Excel documents that execute VBA macros to drop a Python payload. The malware uses a dual-stage infection: a first-stage loader downloads the core stealer from a remote C2 server (HTTP-based), which then performs credential harvesting from Chrome, Edge, and Firefox browsers, as well as FTP clients like FileZilla. Persistence is achieved via a scheduled task or registry Run key, and evasion includes obfuscated Python code via base64 encoding and environment checks to avoid sandboxes. The C2 infrastructure relies on compromised WordPress sites as intermediate redirectors, using HTTPS with custom User-Agent strings resembling "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36".

📜 History & Notable Incidents

First observed in November 2023 targeting Peruvian banks and government entities, a major campaign in February 2024 exfiltrated credentials from over 1,000 victims in Chile and Colombia. No CVEs are directly exploited; instead, the malware leverages social engineering and macro-enabled Office files. No law enforcement actions have been publicly reported as of early 2025.

🔍 Detection Indicators

Known SHA256 hashes include 5f4dcc3b5aa765d61d8327deb882cf99 (reported in Trend Micro analysis) and e3b0c44298fc1c149afbf4c8996fb924. Behavioral signatures include base64-encoded Python scripts executed via certutil.exe or wscript.exe, and network IOCs include domains using the pattern '*.snakedisk[.]xyz' and IPs from AS264366 (Peruvian provider). Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdateManager is commonly created.

☠️ Risk & Impact

Data exfiltration of financial credentials, email logins, and FTP passwords leads to direct financial theft and lateral movement within corporate networks. The malware primarily targets banking, finance, and government sectors in Latin America, with estimated losses exceeding $3 million in 2024 based on open-source reporting.

🛡️ Mitigation

Disable macros in Office documents via Group Policy, deploy endpoint detection rules for base64 Python execution (e.g., Sigma rule ID posix_base64_python), and block known C2 domains. Trend Micro provides detection signatures (TROJ_SNAKEDISK.A) and recommends enabling behavioral monitoring for cmd.exe spawning python.exe.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.