diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index 4cc50bd..9da78b3 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -63,6 +63,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software |[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet has the option to compress its payload using UPX or MPRESS. [[6]](#6)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)| |[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)| +|[**Snake**](../xample-malware/snake.md)|2004|--|Snake is distributed in a packed format. [[9]](#9)| ## Detection @@ -135,3 +136,5 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software [8] https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf +[9] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + diff --git a/collection/keylogging.md b/collection/keylogging.md index 85e5dad..be168f5 100644 --- a/collection/keylogging.md +++ b/collection/keylogging.md @@ -56,6 +56,7 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te |[**Redhip**](../xample-malware/redhip.md)|2011|F0002.002|Malware logs keystrokes via polling. [[9]](#9)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)| |[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)| +|[**Snake**](../xample-malware/snake.md)|2004|F0002.001|Malware logs keystrokes via application hook. [[10]](#10)| ## Detection @@ -104,3 +105,5 @@ setnz al ; if the previous condition is not met (the zero flag is 1), a 1 [9] capa v4.0, analyzed at MITRE on 10/12/2022 +[10] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + diff --git a/collection/screen-capture.md b/collection/screen-capture.md index 5e256da..c98a454 100644 --- a/collection/screen-capture.md +++ b/collection/screen-capture.md @@ -49,6 +49,7 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/ |[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Malware captures screenshots. [[5]](#5)| |[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)| +|[**Snake**](../xample-malware/snake.md)|2004|--|Malware captures screenshots. [[6]](#6)| ## Detection @@ -96,3 +97,5 @@ call dword ptr [->GDI32.DLL::BitBlt] ; Windows API function to transfer a rec [5] capa v4.0, analyzed at MITRE on 10/12/2022 +[6] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 5caab52..cdd1ffb 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -48,6 +48,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 |[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)| |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)| |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)| +|[**Snake**](../xample-malware/snake.md)|2004|--|Snake can delete itself. [[5]](#5)| ## Detection @@ -71,3 +72,5 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 [3] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection [4] https://www.mandiant.com/resources/blog/wannacry-malware-profile + +[5] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index 84af72c..d7ee0d5 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -62,6 +62,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)| |[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)| +|[**Snake**](../xample-malware/snake.md)|2004|--|Snake gets the OS version, disk size, machine name, and geographic location [[11]](#11)| ## Detection @@ -135,3 +136,5 @@ call dword ptr [->KERNEL32.DLL::GetEnvironmentVariableW] ; call function [9] capa v4.0, analyzed at MITRE on 10/12/2022 [10] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ + +[11] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware diff --git a/micro-behaviors/cryptography/crypto-library.md b/micro-behaviors/cryptography/crypto-library.md index da499c6..e85b1af 100644 --- a/micro-behaviors/cryptography/crypto-library.md +++ b/micro-behaviors/cryptography/crypto-library.md @@ -37,6 +37,12 @@ Malware uses a crypto library. |**API Call**|C0059.001|Malware uses crypto API calls.| |**Static Public Library**|C0059.002|A public crypto library is embedded in the code.| +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**Snake**](../../xample-malware/snake.md)|2004|C0059.001|Snake uses API calls to interface with cryptographic libraries. [[1]](#1)| + ## Detection |Tool: capa|Mapping|APIs| @@ -46,3 +52,7 @@ Malware uses a crypto library. |[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)|--| |[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)|--| |[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)|--| + +## References + +[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md index 3e6b812..781e54f 100644 --- a/micro-behaviors/cryptography/decrypt-data.md +++ b/micro-behaviors/cryptography/decrypt-data.md @@ -55,6 +55,8 @@ Malware may decrypt data. |---|---|---|---| |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)| |[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt [[1]](#1)| +|[**Snake**](../../xample-malware/snake.md)|2004|C0031.001|Decrypts credential stores using AES [[2]](#2)| +|[**Snake**](../../xample-malware/snake.md)|2004|C0031.005|Decrypts .NET assembly with 3DES [[2]](#2)| ## Detection @@ -129,3 +131,5 @@ retn [1] capa v4.0, analyzed at MITRE on 10/12/2022 +[2] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + diff --git a/micro-behaviors/data/decode-data.md b/micro-behaviors/data/decode-data.md index 4d25a5b..fd5e8b9 100644 --- a/micro-behaviors/data/decode-data.md +++ b/micro-behaviors/data/decode-data.md @@ -36,3 +36,13 @@ Malware may decode data. |---|---|---| |**Base64**|C0053.001|Malware may decode data using base64.| |**XOR**|C0053.002|Malware may use XOR to decode data.| + +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**Snake**](../xample-malware/snake.md)|2004|C0053.001|Snake decodes data stored in base64 during the unpacking process [[1]](#1)| + +## References + +[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware diff --git a/micro-behaviors/file-system/copy-file.md b/micro-behaviors/file-system/copy-file.md index c9fabc8..884340e 100644 --- a/micro-behaviors/file-system/copy-file.md +++ b/micro-behaviors/file-system/copy-file.md @@ -40,6 +40,7 @@ Malware copies a file. |[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)| |[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip copies files. [[1]](#1)| |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)| +|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake copies files. [[2]](#2)| ## Detection @@ -55,3 +56,5 @@ Malware copies a file. [1] capa v4.0, analyzed at MITRE on 10/12/2022 +[2] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + diff --git a/micro-behaviors/file-system/create-file.md b/micro-behaviors/file-system/create-file.md index af04393..abf34af 100644 --- a/micro-behaviors/file-system/create-file.md +++ b/micro-behaviors/file-system/create-file.md @@ -37,6 +37,12 @@ Malware creates a file. |**Create Office Document**|C0016.001|An Office document is created.| |**Create Ransomware File**|C0016.002|Create a file used by ransomware.| +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake creates files. [[1]](#1)| + ## Detection |Tool: capa|Mapping|APIs| @@ -71,3 +77,8 @@ Malware creates a file. |[stack_pivot_file_created](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stack_pivot.py)|StackPivotFileCreated|Create File (C0016)|NtCreateFile| |[masslogger_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerFiles|Create File (C0016)|--| |[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|StealthFile|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile| + +## References + +[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + diff --git a/micro-behaviors/file-system/delete-file.md b/micro-behaviors/file-system/delete-file.md index c1e148b..7d81ebd 100644 --- a/micro-behaviors/file-system/delete-file.md +++ b/micro-behaviors/file-system/delete-file.md @@ -47,6 +47,7 @@ Malware deletes a file. |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)| |[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)| |[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)| +|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake deletes files. [[2]](#2)| ## Detection @@ -84,3 +85,6 @@ sbb eax, eax ; isolate the carry flag from the previous comparison. [1] capa v4.0, analyzed at MITRE on 10/12/2022 +[2] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + + diff --git a/xample-malware/snake.md b/xample-malware/snake.md index 3481f75..55cbb8c 100644 --- a/xample-malware/snake.md +++ b/xample-malware/snake.md @@ -9,7 +9,7 @@ Aliases -None +Uroburos Platforms @@ -21,7 +21,7 @@ Associated ATT&CK Software -None +Uroburos @@ -30,12 +30,36 @@ The Snake malware is an information-stealing malware that is implemented in the .NET programming language. It has been in use since 2004 and is one of the most sophisticated cyber espionage tools designed and used by Russia's FSB for long-term intelligence collection. [[1]](#1) +## ATT&CK Techniques + +See ATT&CK: [Uroburos](https://attack.mitre.org/software/S0022/) + +## Enhanced ATT&CK Techniques + +|Name|Use| +|---|---| +|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)| The Snake malware is distributed in a packed format [[1]](#1)| +|[Anti-Static Analysis::Software Packing::Confuser (F0001.009)](../anti-static-analysis/software-packing.md)| Some analyzed Snake samples have been packed with Confuser [[2]](#2)| +|[Defense Evasion::Self-Deletion (F0007)](../defense-evasion/self-deletion.md)| Snake can delete itself to prevent detection. [[1]](#1)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)| Snake collects information about the host on which it is running and its probable geographic location. [[1]](#1)| +|[Collection::Keylogging::Application Hook (F0002.001)](../collection/keylogging.md)| Snake uses SetWindowsHookExA to monitor for and log keystrokes. [[1]](#1)| +|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)| Snake captures screenshots. [[1]](#1)| + ## MBC Behaviors |Name|Use| |---|---| -|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)| +|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)| Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)| +|[Data::Decode Data::Base64 (C0053.001)](../micro-behaviors/data/decode-data.md)| Snake decodes information stored in base64 during the unpacking process observed in [[1]](#1)| +|[Cryptography::Decrypt Data::3DES (C0031.005)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts a .NET assembly encrypted with 3DES during the unpacking process observed in [[1]](#1)| +|[Cryptography::Decrypt Data::AES (C0031.001)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts credentials stored in web browsers using AES. [[1]](#1)| +|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)| Snake copies its executable to another location while establishing persistence. [[1]](#1)| +|[File System::Create File (C0016)](../micro-behaviors/file-system/create-file.md)| Snake creates a scheduled task configuration file [[1]](#1)| +|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)| Snake can delete image files created when screenshots are captured. [[1]](#1)| +|[Cryptography::Crypto Library::API Call (C0059.001)](../micro-behaviors/cryptography/crypto-library.md)| Snake uses the Network Security Services library to decrypt some credentials stored in browsers. [[1]](#1)| ## References [1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware + +[2] https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/