YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1

Hunting Russian Intelligence Snake Malware

APT / threat actorWindows Malware SnakeSignature Base (Florian Roth / Nextron)MIT LicenseCompiles with YARA-X (with warnings)

Author: Matt Suiche (Magnet Forensics)
Date: 2023-05-10
Modified: 2025-03-21
Score / Quality: 70 / 71

What this rule detects

Hunting Russian Intelligence Snake Malware

Associated malware family: Windows Malware Snake.

It defines 7 patterns (0 text, 7 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-ru-win-snake-malware-may23-1.yarMIT License

rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
{
	meta:
		description = "Hunting Russian Intelligence Snake Malware"
		author = "Matt Suiche (Magnet Forensics)"
		id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"
		date = "2023-05-10"
		modified = "2025-03-21"
		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_ru_snake_may23.yar#L17-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
		score = 70
		quality = 71
		tags = "MEMORY"
		threat_name = "Windows.Malware.Snake"
		scan_context = "memory"
		license = "MIT"

	strings:
		$a = { 25 73 23 31 }
		$b = { 25 73 23 32 }
		$c = { 25 73 23 33 }
		$d = { 25 73 23 34 }
		$e = { 2e 74 6d 70 }
		$g = { 2e 73 61 76 }
		$h = { 2e 75 70 64 }

	condition:
		all of them
}

Strings (7 patterns)

Identifier	Type	Value
$a	hex	{ 25 73 23 31 }
$b	hex	{ 25 73 23 32 }
$c	hex	{ 25 73 23 33 }
$d	hex	{ 25 73 23 34 }
$e	hex	{ 2e 74 6d 70 }
$g	hex	{ 2e 73 61 76 }
$h	hex	{ 2e 75 70 64 }

Condition

all of them

In plain words (Heuristic)

All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF

Licence & attribution

Author: Matt Suiche (Magnet Forensics)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: MIT License (stated in the rule's own meta)

“MIT”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 53d2de3c-350c-5090-84bb-b6cde16a80ad

Metadata

threat_name	Windows.Malware.Snake
scan_context	memory

Tags:MEMORY