Rewterz Threat Alert – SNAKE Ransomware – Active IOCs

Severity

High

Analysis Summary

Snake emerged for the first time in late November 2020. Since November 2020, malicious actors have started releasing Snake through phishing attacks. Snake Ransomware is built-in Golang, an open-source programming language that supports several operating systems. It deletes the computer’s Shadow Volume Copies and terminates processes linked to SCADA systems, virtual machines, industrial control systems, remote management tools, network management applications, and other programs. This ransomware has been attacking industrial control systems’ operations and files. Snake bypasses all Windows and other system directories on the machine during encryption. In comparison to other ransomware attacks, its encryption procedure is slower.

Impact

• File encryption

Indicators of Compromise

MD5

• 8462f870ee3a4b6cd840f940f41d3161

SHA-256

• 26d67ec38fb2cf947cc71182166947fa4824789ccc14e1ffb45fac833e9bbe34

SHA-1

• 354ba403bdb72a90832128c523f13f3127743f67

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.