Analysing a 10-Year-Old SNOWBALL
Summary: Unit 42 found a 2007-compiled sample of the Babar implant, also known as SNOWBALL, part of the Animal Farm toolkit, predating previously known samples from 2011. The loader stores its payload DLL in a resource named MYRES, injects it into a suspended Internet Explorer process via CreateRemoteThread, and the payload uses RC4 with the key +37:*$pK#s to encrypt configuration data pointing to a compromised C2 at cpcc-rdc.org, the official site of the Permanent Council of Accounting of the Democratic Republic of the Congo.
What's compelling: The adversary behind this toolkit used a national accounting body's website as its command server, and the sample's own code left most configuration data in clear text - a reminder that long-dormant implants tied to real third-party domains can resurface years after the campaign ended.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026