Skip to content
Threat Feed
Subscribe

Tag

Snake-Malware

2 briefs RSS
high advisory

Snake Malware Registry Modification via .wav\OpenWithProgIds

Snake malware modifies the .wav\OpenWithProgIds registry path to facilitate the decryption of configuration blobs used by WerFault.exe to load malicious kernel drivers.

snake-malware registry defense-evasion persistence
1r 1t
high advisory

Detection of Snake Malware Kernel Driver Installation Artifacts

Snake Malware utilizes the creation of a specifically named file, 'comadmin.dat', within the system32\Com directory to facilitate the installation and loading of a malicious kernel driver for persistence and privilege escalation.

snake-malware kernel-driver persistence turla windows
1r 1t