Turla__2014__circl-tr25-analysis-turla-pfinet-snake-uroburos.pdf

TR-25 analyzes the Uroburos (Turla/Snake/Uroburos) rootkit, summarizing static and dynamic analyses of samples A–H. It details a multi‑component infection with a kernel‑mode driver (usbdev.sys) and several userland modules (inetpub.dll, cryptoapi.dll, config.txt), persistence via services, resource‑driven drops, inter‑process communication, mutexes for access control, a virtual file system, and decryption routines; the report also documents IOCs, transport modules (tcp/np/frag/m2b), check‑in messages, and extensive logging, indicating a sophisticated state‑sponsored malware framework attributed to the Turla group.