Turla__2014__uroburos.pdf
ID: 5f1c0853-d8a3-4adb-97fa-12979271b2f5
STIX ID: report--5f1c0853-d8a3-4adb-97fa-12979271b2f5
Threat Score
78/100
Uploaded: 2026-08-19
Published Date: 2014-03-12
Last Modified Date: 2014-03-12
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
The document provides a detailed technical analysis of the Snake/Uroburos rootkit, describing kernel-mode injection, process hiding, hooking and PatchGuard bypass on x64, a modular userland architecture, a robust communication framework, and persistent/volatile virtual file systems with encrypted I/O, along with IOCs, Yara rules, and bootstrap queue data to aid detection and response in targeted attacks.