APT_MAL_RU_Snake_Malware_Queue_File_May23_1

rule APT_MAL_RU_Snake_Malware_Queue_File_May23_1 {
   meta:
      description = "Detects Queue files used by Snake malware"
      author = "Florian Roth"
      reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
      date = "2023-05-10"
      score = 80
      id = "c7ed554e-b55e-5c3f-aa8b-231cb1073f34"
   condition:
      filename matches /(\{[0-9A-Fa-f]{8}\-([0-9A-Fa-f]{4}\-){3}[0-9A-Fa-f]{12}\}\.){2}crmlog/
      /* and filepath contains "\\Registration\\" // not needed - already specific enough */
      // we reduce the range for the entropy calculation to the first 1024 for performance
      // reasons. In a fully encrypted file - as used by Snake - this should already be specific enough
      //and math.entropy(0, filesize) >= 7.0
      and math.entropy(0, 1024) >= 7.0
}