Skip to content

Instantly share code, notes, and snippets.

@msuiche
Last active May 16, 2024 17:16
Show Gist options
  • Save msuiche/8c8fd278430dda0292b4cfdfc549ca2d to your computer and use it in GitHub Desktop.
Save msuiche/8c8fd278430dda0292b4cfdfc549ca2d to your computer and use it in GitHub Desktop.
/*
Hunting Russian Intelligence “Snake” Malware
The Snake implant is considered the most sophisticated cyber espionage tool designed and used by
Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive
targets.
*/
rule Windows_Snake_Malware {
meta:
author = "Matt Suiche (Magnet Forensics)"
description = "Hunting Russian Intelligence Snake Malware"
creation_date = "2023-05-10"
threat_name = "Windows.Malware.Snake"
reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
severity = 100
scan_context = "memory"
license = "MIT"
os = "windows"
/* The original search only query those bytes in PAGE_EXECUTE_WRITECOPY VADs */
strings:
$a = { 25 73 23 31 }
$b = { 25 73 23 32 }
$c = { 25 73 23 33 }
$d = { 25 73 23 34 }
$e = { 2e 74 6d 70 }
$f = { 2e 73 61 76 }
$g = { 2e 75 70 64 }
condition:
all of them
}
@msuiche
Copy link
Author

msuiche commented May 13, 2023

Let's goooo! This is so old!

Creation Time	2016-07-29 09:20:28 UTC
First Submission	2018-02-28 09:24:26 UTC
Last Submission	2023-05-12 12:20:12 UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment