Loading malware…
Snake is an ambiguous malware name used for at least three distinct families: the EKANS/Snake ransomware, the Snake/Uroburos espionage platform associated with Turla, and a separate .NET information-stealing malware also called Snake. The supplied facts most strongly support Snake as EKANS, a targeted Golang ransomware family that emerged in late 2019 and has been used against enterprise environments, including healthcare and industrially relevant organizations. EKANS encrypts files on accessible drives, appends an EKANS marker to encrypted data, uses hybrid cryptography with per-file symmetric encryption protected by an embedded RSA public key, and commonly attempts to preserve system operability by excluding some Windows components. It is notable for aggressively terminating processes and services, including security, backup, enterprise management, and some industrial software, and for manipulating Windows Firewall settings to isolate the host during encryption. Observed variants also delete shadow copies and use environment checks, including victim-specific DNS validation and domain-role checks, to restrict execution and alter behavior on domain controllers. Reporting has also associated Snake ransomware with double-extortion-era victimology, including attacks or attempted attacks against major enterprises.
The name Snake is also widely used for Uroburos, a sophisticated Windows rootkit and espionage framework linked to the Turla threat actor and Russian intelligence. That malware is modular, stealth-focused, capable of arbitrary command execution, traffic capture, file theft, peer-to-peer relaying, and long-term covert access in high-value government and enterprise networks.
Separately, Snake has been used for a commodity .NET infostealer and keylogger active since late 2020, typically delivered through phishing or malicious archive attachments. That malware supports credential theft from browsers and client applications, keylogging, clipboard theft, screenshot capture, persistence, and exfiltration via multiple channels.
Because these families share the same name, operational use of the label "Snake" requires disambiguation to avoid conflating ransomware, espionage malware, and infostealer activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The first type of downloader we’ve seen used to deploy Snake are RTF documents containing the well-known Microsoft Office Equation Editor exploit (CVE-2017-11882). | Snake is a modular .NET keylogger and credential stealer first spotted in late November 2020.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For the Uroburos rootkit, they used a modified version of ThreeFish. | For Carbon and Snake, they used CAST-128.
Les victimes étaient des entités ministérielles, visées par exemple en 2014 par le code malveillant Uroburos.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
At the current stage of the investigations it is unknown how Uroburos initially infiltrates high profile networks. Many infection vectors are conceivable. E.g. spear phishing, drive-by-infections, USB sticks, or social engineering attacks.
Campaigns delivering Snake in 2021 used malicious spam to distribute the malware, either in RTF or archive attachments.
Malicious actors distribute Snake as attachments to phishing emails with various themes, such as payment requests. The attachments are typically archive files with file name extensions such as img, zip, tar, and rar, and store a .NET executable that implements the Snake malware.
First, SNAKE uses WMI queries to refer the domain role value.
CF_Secretaria creates a scheduled task named, for example, Updates\vxhnIvyvbHAK. To create this scheduled task, CF_Secretaria issues the following command: C:\Windows\System32\schtasks.exe /Create /TN Updates\vxhnIvyvbHAK /XML C:\Users\User\AppData\Local\Temp\tmp55AB.tmp
CF_Secretaria creates a scheduled task named, for example, Updates\vxhnIvyvbHAK. To create this scheduled task, CF_Secretaria issues the following command: C:\Windows\System32\schtasks.exe /Create /TN Updates\vxhnIvyvbHAK /XML C:\Users\User\AppData\Local\Temp\tmp55AB.tmp
CF_Secretaria creates a scheduled task named, for example, Updates\vxhnIvyvbHAK. To create this scheduled task, CF_Secretaria issues the following command: C:\Windows\System32\schtasks.exe /Create /TN Updates\vxhnIvyvbHAK /XML C:\Users\User\AppData\Local\Temp\tmp55AB.tmp
It confirmed that the government institution had been infected with the spyware Uroburos, which is also called "Snake" in some cases.
To reduce chances of detection by endpoint security tools, the Snake samples we analysed were packed.
一般的なランサムウェアは一ファイルずつファイルを暗号化→拡張子変更の流れをとるのではなく、全てのファイルに対する暗号化を一通り実施した後に、最後にまとめてファイルの拡張子だけを変更していきます。...挙動検知などに対する検知逃れの効果などが考えられます。
The Snake malware uses the SetWindowsHookExA and CallNextHookEx functions to capture key press events.
Snake first invokes the netsh wlan show profile command to list existing wireless network profiles and then retrieves these from the command output.
A unique feature of this specimen is that it specially works when the work environment is a domain controller... First, SNAKE uses WMI queries to refer the domain role value.
Snake can gather the following type of information about the compromised environment in which the malware runs: Operating system and hardware information: Snake obtains the operating system name and version, amount of hard disk and physical memory, and machine name.
The Snake malware gathers operating system, hardware, geolocation, and date-time information.
Snake can steal saved credentials from credential databases of communication platforms, FTP clients, email clients, and web browsers.
The Snake malware uses the SetWindowsHookExA and CallNextHookEx functions to capture key press events.
Snake can exfiltrate logged keystrokes and stolen credentials, clipboard data, and screenshots using the following protocols: FTP... SMTP... Telegram/HTTPS... Snake can exfiltrate logged keystrokes, screenshots, clipboard data, and credentials on a regularly timed interval.
Snake can exfiltrate logged keystrokes, screenshots, clipboard data, and credentials on a regularly timed interval.
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound / netsh advfirewall set allprofiles state on
SNAKEが動作して良い環境であることを認識すると、続いてWindowsファイアウォールの設定を変更します。具体的には、netsh.exeに、以下のコマンドラインを渡して実行します。 netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
To avoid detection, Snake can disable solutions that may detect the malware’s operation by killing associated processes, such as the avastui process, which is related to the Avast antivirus, and the wireshark process, which is related to the Wireshark network traffic analyzer.
71 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
99 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A keylogger and information stealer.
Russian malware used against Ukrainian government systems in the context of pre-invasion cyber espionage and disruption.
A sophisticated long-term cyberespionage implant used for covert access, persistence, and strategic intelligence collection.
Ransomware family mentioned as targeting healthcare and medical facilities during the COVID period.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.