Re:Hunting Russian Intelligence “Snake” Malware
by stevenlafl on Tuesday May 09, 2023 @11:58PM
(#35883488)
I implemented the Suricata rules and found some positive indicators outbound to 4 different Akamai hosted endpoints on port 80. I forwarded the information to Akamai.
However, the detection techniques on the host machine yielded no results (yara, volatility3) nor were any files found at the common locations on disk or in registry mentioned.
It does seem odd that virtually all of these are Akamai, leading me to believe it may be a false positive, which was stated as a possibility in the article. If it is and something suddenly stops working I'll report back here.
104.113.24.20 23.38.164.37 23.63.214.115 23.64.100.151
However, the detection techniques on the host machine yielded no results (yara, volatility3) nor were any files found at the common locations on disk or in registry mentioned.
It does seem odd that virtually all of these are Akamai, leading me to believe it may be a false positive, which was stated as a possibility in the article. If it is and something suddenly stops working I'll report back here.