snatch | e90633e63fb5fdd6ba36d129b5b6cbaa94ad958dfde383893f21a960cac60bc5

Sharing

Copy URL

Twitter E-mail

General

Target

e90633e63fb5fdd6ba36d129b5b6cbaa94ad958dfde383893f21a960cac60bc5
Size

4.3MB
MD5

d9a272d512e8e3d7a7e399084d721888
SHA1

69b33af91bc43d37d394481bb6e943c2a65aafa2
SHA256

e90633e63fb5fdd6ba36d129b5b6cbaa94ad958dfde383893f21a960cac60bc5
SHA512

45978e58b6937b3ff1ef987b7f4dfc72ed99e3f50daddd754c256a5e28b59f4731c2e62f8309b195037769f4b120ba488e03e3a9da2094ba543dbb33619d9cb6
SSDEEP

98304:fENOC6i3WsC5tDdEbxagq3dNUh0hV5iyZOM4:fENOCX3WsC5tZLgIGo52M4

Score

10^/10

snatch

Malware Config

Signatures

Detecting the common Go functions and variables names used by Snatch ransomware 1 IoCs

Processes:

resource yara_rule

sample family_snatch
Snatch family
snatch

resource	yara_rule
sample	family_snatch

Files

e90633e63fb5fdd6ba36d129b5b6cbaa94ad958dfde383893f21a960cac60bc5
.exe windows x64

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 281B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 40B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 469KB - Virtual size: 469KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 137KB - Virtual size: 443KB

/4 Size: 512B - Virtual size: 281B

/19 Size: 248KB - Virtual size: 247KB

/32 Size: 49KB - Virtual size: 48KB

/46 Size: 512B - Virtual size: 40B

/65 Size: 469KB - Virtual size: 469KB

/78 Size: 251KB - Virtual size: 250KB

/90 Size: 87KB - Virtual size: 86KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 54KB - Virtual size: 53KB

.symtab Size: 208KB - Virtual size: 208KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 137KB - Virtual size: 443KB

/4
Size: 512B - Virtual size: 281B

/19
Size: 248KB - Virtual size: 247KB

/32
Size: 49KB - Virtual size: 48KB

/46
Size: 512B - Virtual size: 40B

/65
Size: 469KB - Virtual size: 469KB

/78
Size: 251KB - Virtual size: 250KB

/90
Size: 87KB - Virtual size: 86KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 54KB - Virtual size: 53KB

.symtab
Size: 208KB - Virtual size: 208KB