{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/snake-malware/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["snake-malware","registry","defense-evasion","persistence"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eSnake malware, a sophisticated espionage tool, utilizes specific registry modifications as a mechanism to decrypt critical configuration data. The malware targets the registry path \u0026quot;.wav\\OpenWithProgIds\u0026quot; to store or trigger the retrieval of encrypted blobs. When accessed by the legitimate Windows process 'WerFault.exe', this registry data is decrypted to reveal essential components, including AES keys, initialization vectors (IVs), and the file paths required to load the malware's custom kernel driver and loader. This technique allows the malware to bypass traditional signature-based detection by keeping its core configuration encrypted and off-disk until runtime. For defenders, monitoring modifications to this specific registry key is a high-fidelity signal of Snake malware activity, as legitimate applications rarely utilize this path for configuration storage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial compromise occurs, allowing the execution of the Snake loader.\u003c/li\u003e\n\u003cli\u003eThe loader prepares the malicious payload and necessary configuration data.\u003c/li\u003e\n\u003cli\u003eThe malware writes an encrypted blob or modifies subkeys within \u0026quot;.wav\\OpenWithProgIds\u0026quot; in the Windows Registry.\u003c/li\u003e\n\u003cli\u003e'WerFault.exe' is invoked or coerced into processing the modified registry values.\u003c/li\u003e\n\u003cli\u003eThe malware uses the stored registry data to derive the AES key and IV.\u003c/li\u003e\n\u003cli\u003eDecryption of the configuration blob exposes paths to the final-stage kernel driver.\u003c/li\u003e\n\u003cli\u003eThe kernel driver is loaded into the operating system memory, granting the attacker persistent, high-privilege access.\u003c/li\u003e\n\u003cli\u003eFinal objective of espionage or exfiltration is achieved through the active kernel-level presence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation by Snake malware results in full system compromise via kernel-level access. This allows for stealthy, long-term persistence that is extremely difficult to detect or remove from the OS. Historically, this malware has targeted sensitive government and critical infrastructure sectors. Compromise leads to significant risks of data exfiltration and complete loss of control over the affected host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect unauthorized modifications to the .wav registry hive.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 13 (Registry Event) logging across all endpoints to capture the necessary 'TargetObject' and 'Details' information.\u003c/li\u003e\n\u003cli\u003eInvestigate any processes modifying the .wav\\OpenWithProgIds key that are not part of a documented, legitimate software update or deployment.\u003c/li\u003e\n\u003cli\u003eUtilize the provided Atomic Red Team test (Guid: 8318ad20-0488-4a64-98f4-72525a012f6b) to validate detection coverage in your environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:22:09Z","date_published":"2026-10-12T18:22:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-snake-malware-registry/","summary":"Snake malware modifies the .wav\\OpenWithProgIds registry path to facilitate the decryption of configuration blobs used by WerFault.exe to load malicious kernel drivers.","title":"Snake Malware Registry Modification via .wav\\OpenWithProgIds","url":"https://feed.craftedsignal.io/briefs/2026-10-snake-malware-registry/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["snake-malware","kernel-driver","persistence","turla","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eSnake Malware, also known as Turla, is a sophisticated threat targeting critical infrastructure and government entities. The malware employs a modular architecture that relies on custom kernel drivers to maintain deep control over compromised systems. A critical component of its installation routine is the creation of a file named 'comadmin.dat' within the '%windows%\\system32\\Com' directory. This file serves as a staging artifact for loading a kernel-mode driver, enabling the threat actor to bypass standard security controls, gain persistent access, and execute arbitrary code with elevated privileges. Monitoring for the creation of this specific file in the system32 directory provides a high-fidelity signal for detecting the active deployment phase of the Snake rootkit.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established via spearphishing or exploiting unpatched edge vulnerabilities.\u003c/li\u003e\n\u003cli\u003eThe threat actor executes a dropper or installer to initiate the malware deployment.\u003c/li\u003e\n\u003cli\u003eThe installer identifies the target system path for the rootkit components.\u003c/li\u003e\n\u003cli\u003eThe installer writes 'comadmin.dat' to 'C:\\Windows\\system32\\Com\\'.\u003c/li\u003e\n\u003cli\u003eThe malware performs a side-loading or registry manipulation to register the associated kernel driver.\u003c/li\u003e\n\u003cli\u003eThe system is rebooted or a service is triggered to load the malicious driver into the Windows kernel.\u003c/li\u003e\n\u003cli\u003eThe driver provides the attacker with kernel-level visibility and persistent control.\u003c/li\u003e\n\u003cli\u003eThe final objective is the exfiltration of sensitive data or long-term espionage within the victim network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful deployment of the Snake kernel driver grants the attacker full visibility into the compromised host's operating system, enabling the interception of network traffic, sensitive file access, and evasion of endpoint detection and response (EDR) agents. This threat is primarily observed in high-value, targeted espionage campaigns against government and diplomatic sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to monitor for the creation of the 'comadmin.dat' file in the specified system path.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 11 (FileCreate) to capture the necessary telemetry for this detection.\u003c/li\u003e\n\u003cli\u003eInvestigate any detected 'comadmin.dat' file creations immediately, as this artifact is highly specific to Snake Malware.\u003c/li\u003e\n\u003cli\u003eReview system and application logs for suspicious service installations or registry modifications corresponding to the timestamp of the file creation event.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:22:00Z","date_published":"2026-10-12T18:22:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-snake-malware/","summary":"Snake Malware utilizes the creation of a specifically named file, 'comadmin.dat', within the system32\\Com directory to facilitate the installation and loading of a malicious kernel driver for persistence and privilege escalation.","title":"Detection of Snake Malware Kernel Driver Installation Artifacts","url":"https://feed.craftedsignal.io/briefs/2026-10-snake-malware/"}],"language":"en","title":"CraftedSignal Threat Feed - Snake-Malware","version":"https://jsonfeed.org/version/1.1"}