ruleAPTSnake.yar

/*
    Hunting Russian Intelligence “Snake” Malware

    The Snake implant is considered the most sophisticated cyber espionage tool designed and used by
    Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive
    targets.
*/

rule Windows_Snake_Malware {
    meta:
        author = "Matt Suiche (Magnet Forensics)"
        description = "Hunting Russian Intelligence Snake Malware"
        creation_date = "2023-05-10"
        threat_name = "Windows.Malware.Snake"
        reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
        severity = 100
        scan_context = "memory"
        license = "MIT"
        os = "windows"

    /* The original search only query those bytes in PAGE_EXECUTE_WRITECOPY VADs */
    strings:
        $a = { 25 73 23 31 }
        $b = { 25 73 23 32 }
        $c = { 25 73 23 33 }
        $d = { 25 73 23 34 }
        $e = { 2e 74 6d 70 }
        $f = { 2e 74 6d 70 }
        $g = { 2e 73 61 76 }
        $h = { 2e 75 70 64 }

    condition:
        all of them
}