cyber.hendryadrian.com
Threat Research · asec.ahnlab.com

Purchase-Order Phishing Emails Deliver SnakeKeylogger Through Malicious DOCX Files

· Original article ↗

Summary

AhnLab describes purchase-order phishing emails that use a malicious DOCX and Equation Editor vulnerability to deliver SnakeKeylogger, which steals credentials and other data.

Key points

  • The phishing email asks recipients to review an attached purchase order and reply with information.
  • The DOCX embeds a malicious RTF that uses an Equation Editor vulnerability to run a VBS script.
  • The script stages encoded payloads and launches Python code that decrypts and loads shellcode in memory.
  • The payload executes SnakeKeylogger, which establishes persistence through the Registry Run key.
  • SnakeKeylogger can steal keystrokes, clipboard data, screenshots, Wi-Fi passwords, browser and email credentials, FileZilla logins, Discord tokens, public IP addresses, and location data.
  • The article lists SnakeKeylogger C2 details, including cphost17[.]Qhoster[.]Net:587.
  • AhnLab advises verifying senders and links, treating attachments cautiously, and checking that sites are official before entering sensitive information.

Article Details

Attack Vectors
  • Phishing emails disguised as purchase-order confirmation requests prompt recipients to open an attached DOCX file.
  • The DOCX contains an RTF file with an Equation.3 object that triggers an Equation Editor vulnerability to run a VBS script.
  • The VBS script launches hidden PowerShell to decode and unpack a payload, which executes SnakeKeylogger.
Defensive Notes
  • Verify that the sender's email address uses an official domain.
  • Check links before clicking and treat unexpected attachments—especially executable or script files—as suspicious.
  • Before entering sensitive information, verify that the page uses the official site's URL; do not proceed if it appears suspicious.

Indicators of compromise

TypeIndicatorContext
EMAILkingmethodlogs2026@exzwzc[.]comIdentified as the SnakeKeylogger C2 email recipient.
EMAILobsender4snake@exzwzc[.]comIdentified as the ID associated with the SnakeKeylogger C2.
HOSTNAMEcphost17[.]qhoster[.]netIdentified as the SnakeKeylogger C2 mail server; the article gives port 587.
MD50552617f3e2400d7bdac63f91d974be4MD5 indicator listed in the article's threat indicators.
MD522d304d7e8ceae68e3e1c9038c6b9046MD5 indicator listed in the article's threat indicators.
MD53a9699a4de2fdfc04d47e671d6ee11bbMD5 indicator listed in the article's threat indicators.
MD546f47d0c02a81ae9ea7b716d404a88b6MD5 indicator listed in the article's threat indicators.
MD5889530cef474d71837a415315b78235bMD5 indicator listed in the article's threat indicators.

MITRE ATT&CK

T1056.001 · KeyloggingSnakeKeylogger steals keyboard input.T1059.001 · PowerShellThe VBS script launches PowerShell in hidden mode to decode and unpack payload data.T1059.005 · Visual BasicThe VBS file is executed through cscript.T1113 · Screen CaptureSnakeKeylogger captures screenshots.T1115 · Clipboard DataSnakeKeylogger steals clipboard data.T1203 · Exploitation for Client ExecutionThe embedded Equation.3 object triggers an Equation Editor vulnerability to execute the VBS script.T1547.001 · Registry Run Keys / Startup FolderSnakeKeylogger establishes persistence through the Registry Run key.T1555.003 · Credentials from Web BrowsersSnakeKeylogger steals browser account information.T1566.001 · Spearphishing AttachmentThe phishing email delivers the malicious DOCX as an attachment.

Malware

SnakeKeyloggerThe shellcode ultimately executes SnakeKeylogger, an Infostealer.

Related Articles