Snake (#179)

* Update snake.md

Updated malware behaviors and descriptions.

* Update snake.md

Divided table to split out enhanced techniques

* Update software-packing.md

Added Snake

* Update self-deletion.md

Added Snake

* Update system-information-discovery.md

Added Snake

* Update keylogging.md

Added Snake

* Update screen-capture.md

* Update decode-data.md

Added Snake

* Update decrypt-data.md

Added Snake

* Update copy-file.md

Added Snake

* Update create-file.md

Added Snake

* Update delete-file.md

* Update crypto-library.md

Added Snake

* Update crypto-library.md

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>

anti-static-analysis/software-packing.md

@@ -63,6 +63,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet has the option to compress its payload using UPX or MPRESS.  [[6]](#6)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)|
 |[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake is distributed in a packed format. [[9]](#9)|
 
 ## Detection
 
@@ -135,3 +136,5 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 
 <a name="8">[8]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
 
+<a name="9">[9]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

collection/keylogging.md

@@ -56,6 +56,7 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
 |[**Redhip**](../xample-malware/redhip.md)|2011|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Snake**](../xample-malware/snake.md)|2004|F0002.001|Malware logs keystrokes via application hook. [[10]](#10)|
 
 ## Detection
 
@@ -104,3 +105,5 @@ setnz   al      ; if the previous condition is not met (the zero flag is 1), a 1
 
 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="10">[10]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

collection/screen-capture.md

@@ -49,6 +49,7 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Malware captures screenshots. [[6]](#6)|
 
 ## Detection
 
@@ -96,3 +97,5 @@ call    dword ptr [->GDI32.DLL::BitBlt] ; Windows API function to transfer a rec
 
 <a name="5">[5]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="6">[6]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

defense-evasion/self-deletion.md

@@ -48,6 +48,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 |[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)|
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
 |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake can delete itself. [[5]](#5)|
 
 ## Detection
 
@@ -71,3 +72,5 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 <a name="3">[3]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
 
 <a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+
+<a name="5">[5]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

discovery/system-information-discovery.md

@@ -62,6 +62,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
 |[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake gets the OS version, disk size, machine name, and geographic location [[11]](#11)|
 
 ## Detection
 
@@ -135,3 +136,5 @@ call    dword ptr [->KERNEL32.DLL::GetEnvironmentVariableW]     ; call function
 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
 <a name="10">[10]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="11">[11]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/cryptography/crypto-library.md

@@ -37,6 +37,12 @@ Malware uses a crypto library.
 |**API Call**|C0059.001|Malware uses crypto API calls.|
 |**Static Public Library**|C0059.002|A public crypto library is embedded in the code.|
 
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0059.001|Snake uses API calls to interface with cryptographic libraries. [[1]](#1)|
+
 ## Detection
 
 |Tool: capa|Mapping|APIs|
@@ -46,3 +52,7 @@ Malware uses a crypto library.
 |[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)|--|
 |[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)|--|
 |[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)|--|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/cryptography/decrypt-data.md

@@ -55,6 +55,8 @@ Malware may decrypt data.
 |---|---|---|---|
 |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
 |[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0031.001|Decrypts credential stores using AES [[2]](#2)|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0031.005|Decrypts .NET assembly with 3DES [[2]](#2)|
 
 ## Detection
 
@@ -129,3 +131,5 @@ retn
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/data/decode-data.md

@@ -36,3 +36,13 @@ Malware may decode data.
 |---|---|---|
 |**Base64**|C0053.001|Malware may decode data using base64.|
 |**XOR**|C0053.002|Malware may use XOR to decode data.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../xample-malware/snake.md)|2004|C0053.001|Snake decodes data stored in base64 during the unpacking process [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/file-system/copy-file.md

@@ -40,6 +40,7 @@ Malware copies a file.
 |[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
 |[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip copies files. [[1]](#1)|
 |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake copies files. [[2]](#2)|
 
 ## Detection
 
@@ -55,3 +56,5 @@ Malware copies a file.
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/file-system/create-file.md

@@ -37,6 +37,12 @@ Malware creates a file.
 |**Create Office Document**|C0016.001|An Office document is created.|
 |**Create Ransomware File**|C0016.002|Create a file used by ransomware.|
 
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake creates files. [[1]](#1)|
+
 ## Detection
 
 |Tool: capa|Mapping|APIs|
@@ -71,3 +77,8 @@ Malware creates a file.
 |[stack_pivot_file_created](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stack_pivot.py)|StackPivotFileCreated|Create File (C0016)|NtCreateFile|
 |[masslogger_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerFiles|Create File (C0016)|--|
 |[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|StealthFile|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/file-system/delete-file.md

@@ -47,6 +47,7 @@ Malware deletes a file.
 |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
 |[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
 |[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake deletes files. [[2]](#2)|
 
 ## Detection
 
@@ -84,3 +85,6 @@ sbb     eax, eax        ; isolate the carry flag from the previous comparison.
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+
+

xample-malware/snake.md

@@ -9,7 +9,7 @@
 </tr>
 <tr>
 <td><b>Aliases</b></td>
-<td><b>None</b></td>
+<td><b>Uroburos</b></td>
 </tr>
 <tr>
 <td><b>Platforms</b></td>
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Associated ATT&CK Software</b></td>
-<td><b>None</b></td>
+<td><b>Uroburos</b></td>
 </tr>
 </table>
 
@@ -30,12 +30,36 @@
 
 The Snake malware is an information-stealing malware that is implemented in the .NET programming language. It has been in use since 2004 and is one of the most sophisticated cyber espionage tools designed and used by Russia's FSB for long-term intelligence collection. [[1]](#1)
 
+## ATT&CK Techniques
+
+See ATT&CK: [Uroburos](https://attack.mitre.org/software/S0022/)
+
+## Enhanced ATT&CK Techniques
+
+|Name|Use|
+|---|---|
+|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)| The Snake malware is distributed in a packed format [[1]](#1)|
+|[Anti-Static Analysis::Software Packing::Confuser (F0001.009)](../anti-static-analysis/software-packing.md)| Some analyzed Snake samples have been packed with Confuser [[2]](#2)|
+|[Defense Evasion::Self-Deletion (F0007)](../defense-evasion/self-deletion.md)| Snake can delete itself to prevent detection. [[1]](#1)|
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)| Snake collects information about the host on which it is running and its probable geographic location. [[1]](#1)|
+|[Collection::Keylogging::Application Hook (F0002.001)](../collection/keylogging.md)| Snake uses SetWindowsHookExA to monitor for and log keystrokes. [[1]](#1)|
+|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)| Snake captures screenshots. [[1]](#1)|
+
 ## MBC Behaviors
 
 |Name|Use|
 |---|---|
-|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)| Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Data::Decode Data::Base64 (C0053.001)](../micro-behaviors/data/decode-data.md)| Snake decodes information stored in base64 during the unpacking process observed in [[1]](#1)|
+|[Cryptography::Decrypt Data::3DES (C0031.005)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts a .NET assembly encrypted with 3DES during the unpacking process observed in [[1]](#1)|
+|[Cryptography::Decrypt Data::AES (C0031.001)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts credentials stored in web browsers using AES. [[1]](#1)|
+|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)| Snake copies its executable to another location while establishing persistence. [[1]](#1)|
+|[File System::Create File (C0016)](../micro-behaviors/file-system/create-file.md)| Snake creates a scheduled task configuration file [[1]](#1)|
+|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)| Snake can delete image files created when screenshots are captured. [[1]](#1)|
+|[Cryptography::Crypto Library::API Call (C0059.001)](../micro-behaviors/cryptography/crypto-library.md)| Snake uses the Network Security Services library to decrypt some credentials stored in browsers. [[1]](#1)|
 
 ## References
 
 <a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+
+<a name="2">[2]</a> https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/