SNUGRIDE (6a42aa10-5b7e-43b0-8c58-414cdaeda453)

SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. Persistence is maintained through a Run registry key.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
SNUGRIDE (6a42aa10-5b7e-43b0-8c58-414cdaeda453)	Tool	Private Cluster (12b524b9-0d94-400f-904f-615f4f764aaf)	Unknown	1
SNUGRIDE (6a42aa10-5b7e-43b0-8c58-414cdaeda453)	Tool	SNUGRIDE - S0159 (3240cbe4-c550-443b-aa76-cc2a7058b870)	Malware	1
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	SNUGRIDE - S0159 (3240cbe4-c550-443b-aa76-cc2a7058b870)	Malware	2
SNUGRIDE - S0159 (3240cbe4-c550-443b-aa76-cc2a7058b870)	Malware	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	2
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	SNUGRIDE - S0159 (3240cbe4-c550-443b-aa76-cc2a7058b870)	Malware	2
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	SNUGRIDE - S0159 (3240cbe4-c550-443b-aa76-cc2a7058b870)	Malware	2
Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118)	Attack Pattern	Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	3
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	3
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	3
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	3