Awesome
Introduction
Snake is a malware storage zoo that was built out of the need for a centralised and unified storage solution for malicious samples that could seamlessly integrate into the investigation pipeline.
Snake is designed to provide just enough information to allow analysts to quickly and efficiently pivot to the most suitable tools for the task at hand. That being said there will be times where the information provided by Snake is more than sufficient. It is a Python based application built on top of Tornado and MongoDB. Scales provide Snake with a variety of functionality from static analysis through to interaction with external services.
For more information, please see: Wiki
The Snake Family
There is more to Snake than just the above, below is a summary:
- snake: The malware storage zoo.
- core: The main guts of Snake and the RESTful API.
- pit: The celery based workers that are used to execute static based commands.
- snake-charmer: The regression based test suite.
- snake-scales: The official repository of snake scales (plugins).
- snake-skin: The Web UI.
- snake-tail: The UNIX based command line UI.
Install
There are a few ways to install Snake, but the install scripts below will install Snake and the Web UI (Snake Skin).
Note: To install these components individually refer to their respective repositories.
Docker
Snake can be run simply with the following commands:
# Get the lastest version of Snake
git clone https://github.com/countercept/snake.git
git submodule init
git submodule update
# Run Snake
sudo docker-compose up
Snake scales can be installed by exec'ing into the Snake container and running snake install:
# Exec into the Snake container
sudo docker exec -it snake_snake_1 /entrypoint.sh /bin/bash
# Install a scale
snake install SCALE_NAME
Production
This is the preferred method and will install Snake and the Web UI (Snake Skin) into the UNIX system.
Dependencies
There are a few dependencies to install Snake and Web UI (Snake Skin).
Required
- (Snake) LibYAML
- (Snake) MongoDB 3.4 or greater
- (Snake) Python 3.5 or greater
- (Snake) Redis
- (Snake Skin) NodeJS 8 or greater
- (Snake Skin) NPM
Optional
- (Snake) libfuzzy & ssdeep
The above can be installed like so:
Ubuntu 17.10
# Install dependencies
sudo apt-get install libyaml-dev mongodb nodejs npm python3-dev python3-pip redis-server libfuzzy-dev ssdeep
Ubuntu 16.04
# Install cURL
sudo apt-get install curl
# Add repository for MongoDB 3.6
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 2930ADAE8CAF5059EE73BB4B58712A2291FA4AD5
echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.6 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.6.list
# Add repository for nodejs 8
curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
# Install dependencies
sudo apt-get update
sudo apt-get install libyaml-dev mongodb-org nodejs python3-dev python3-pip redis-server libfuzzy-dev ssdeep
# Update pip and setuptools
sudo -H pip3 install --upgrade pip setuptools
git clone https://github.com/countercept/snake.git
cd snake
sys/install.sh
To start Snake:
# Start Snake Pit and Snake services
systemctl start snake-pit
systemctl start snake
To serve Snake Skin (port: 3000):
# Start Snake Skin
systemctl start snake-skin
Scales (Plugins)
By default Snake only provides three core scales:
- hashes: a command based scale used to perform a variety of hashing techniques on a sample.
- strings: a command based module to run strings on a sample.
- url: an upload based component used to upload samples to Snake from URLs.
Installing Additional Scales
Additional Scales are available at snake-scales
Snake provides a wrapper around pip to ease the installation of scales. A scale can be installed with this utility like so:
snake install virustotal
A scale can be checked at any time to see if it will successfully load in Snake.
snake check virustotal
Note: Whenever a new scale is installed, Snake and Celery must be restarted.
To create a scale, please see Scale Documentation
Usage
Both installations will serve Snake on port 5000 (API) and Snake Skin on port 8000.
To communicate with the WebUI:
Visit http://127.0.0.1:8000
To communicate with the API:
curl http://127.0.0.1:5000
Screenshots
Details View
An overview of a sample that has been uploaded to Snake, with additional data enrichment from Cuckoo and VirusTotal.
Notes View
Stores an user written notes about the sample.
Analysis View
This view is used to execute and view commands on a sample.
Interfaces View
This view is used to communicate with external services in relation to a sample.
Configuration
For an overview of Snake's settings, please see Snake
For an overview of Snake Skin's settings, please see Snake Skin