Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.

Uroburos can use custom communication methodologies that ride over common protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic.

Uroburos can use its `Get` command to exfiltrate specified files from the compromised system.

Uroburos can use up to 10 channels to communicate between implants.

Uroburos can query the Registry, typically `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.

Uroburos uses a custom packer.

The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.

Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.`

Uroburos can use AES and CAST-128 encryption to obfuscate resources.

Uroburos has registered a service named `WerFaultSvc`, likely to spoof the legitimate Windows error reporting service.

Uroburos can use DLL injection to load embedded files and modules.

Uroburos can use its `Process List` command to enumerate processes on compromised hosts.

Uroburos has the ability to use the command line for execution on the targeted system.

Uroburos can run a `Clear Agents Track` command on an infected machine to delete Uroburos-related logs.

Uroburos can use a custom HTTP-based protocol for large data communications that can blend with normal network traffic by riding on top of standard HTTP.

Uroburos can use custom communications protocols that ride over SMTP.

Uroburos has encoded outbound C2 communications in DNS requests consisting of character strings made to resemble standard domain names. The actual information transmitted by Uroburos is contained in the part of the character string prior to the first ‘.’ character.

Uroburos has the ability to gather basic system information and run the POSIX API `gethostbyname`.

Uroburos can search for specific files on a compromised system.

Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.

Uroburos can communicate through custom methodologies for UDP, ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.

Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.

Uroburos can use a `Put` command to write files to an infected machine.

Uroburos can use native Windows APIs including `GetHostByName`.

Uroburos can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other Uroburos components.

Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.

Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.

Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.

Uroburos has registered a service, typically named `WerFaultSvc`, to decrypt and find a kernel driver and kernel driver loader to maintain persistence.

Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.

Uroburos can use concealed storage mechanisms including an NTFS or FAT-16 filesystem encrypted with CAST-128 in CBC mode.

Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.

Uroburos can encrypt the data beneath its http2 or tcp encryption at the session layer with CAST-128, using a different key for incoming and outgoing data.

Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.

Uroburos has the ability to load new modules directly into memory using its `Load Modules Mem` command.