{
  "family": "snarasite",
  "sample_count": 70,
  "category": "trojan",
  "description": "Snarasite (cataloged across security vendors and academic research datasets under signatures including Trojan:Win32/Snarasite, Win32/Snarasite, and Snarasite.D!tr) is a persistent Windows trojan family and initial access dropper active since 2014. Notably prominent in cybersecurity literature, Snarasite represents a key benchmark class within the MaleVis and Fusion Malware Datasets used globally to evaluate deep learning and convolutional neural network (CNN) models on binary image classification. In practical attacks, Snarasite propagates via compromised web portals and deceptive software installers. Once executed on an endpoint, the trojan unpacks obfuscated PE sections, registers autostart entries under Windows CurrentVersion\\Run, and initiates HTTP beaconing to command servers. Snarasite is capable of dropping secondary surveillance modules, executing terminal commands, and exfiltrating system profiling data.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Snarasite",
    "Win32/Snarasite",
    "Snarasite.D!tr",
    "Trojan.Win32.Snarasite"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Snarasite?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Snarasite is a Windows trojan and dropper widely studied in academic malware machine learning classification benchmarks."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Snarasite prominent in machine learning cybersecurity research?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is a standard benchmark class in datasets like MaleVis and Fusion used for training vision models on PE binaries."
      }
    },
    {
      "@type": "Question",
      "name": "How does Snarasite maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries under Windows CurrentVersion\\Run and creates scheduled system tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What functions does Snarasite carry out once executed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It unpacks encrypted payloads, beacons to command-and-control servers, and downloads secondary components."
      }
    },
    {
      "@type": "Question",
      "name": "How can Snarasite infections be remediated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer, run a full antimalware scan with Microsoft Defender, and inspect scheduled tasks."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1547.001",
    "T1105",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the harvested credential archives.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Snarasite payload and identify the specific C2 infrastructure it is communicating with.",
    "Assume all locally saved passwords have been compromised; perform a clean OS rebuild to ensure the infostealer is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the infostealer may include keylogging capabilities.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Malware Staging & System Infiltration",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Installers",
    "Compromised Websites & Malvertising",
    "Pirated Software Packages"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Obfuscated Binary Unpacking",
    "Registry Autostart Persistence",
    "Secondary Payload Downloading",
    "Host Telemetry Beaconing",
    "Command Shell Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET/POST traffic to remote C2 endpoints",
      "Beaconing with system architecture and OS version strings"
    ],
    "evasion_techniques": [
      "Encrypted binary sections designed to defeat simple string searches",
      "Anti-emulation timing loops"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Snarasite",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinServiceHost"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "System configuration exfiltration, secondary malware installation, persistent host compromise"
  },
  "lineage": {
    "derived_from": [
      "Win32 Multi-Stage Dropper Frameworks"
    ],
    "variants": [
      "Snarasite.A",
      "Snarasite.D"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e",
      "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f"
    ],
    "delivery": [
      "setup_patch.exe",
      "snarasite_loader.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SnarasiteDaemon",
      "%Temp%\\snarasite_host.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Snarasite",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Snarasite"
    },
    {
      "name": "MaleVis Malware Dataset - Academic Research Benchmark",
      "url": "https://www.kaggle.com"
    }
  ]
}