snatch | 852a1558ef3f4b0732cc991e7052bd1e346e27849bbd53bc2f37172a3490dc7a

Sharing

Copy URL

Twitter E-mail

General

Target

852a1558ef3f4b0732cc991e7052bd1e346e27849bbd53bc2f37172a3490dc7a
Size

4.3MB
MD5

f52484b3ced180721fa57d17ccb9eb37
SHA1

9d9abba79bc22f2bc80a6b73bdca5ce0b0b3e779
SHA256

852a1558ef3f4b0732cc991e7052bd1e346e27849bbd53bc2f37172a3490dc7a
SHA512

a40d440b301b3e95e9fb8fd85998b3dc94fd95ed0a955da5c123d17b550b9d16d01b0f34c5bd1abc895931b46526dcea6886fca49a4d1a5d0cc85d8174bcdc29
SSDEEP

98304:FNheXW6dkEUxOxfEb+MHtOdcBq1qiyZOM4:FNheXrdkEUxOx8HKAv2M4

Score

10^/10

snatch

Malware Config

Signatures

Detecting the common Go functions and variables names used by Snatch ransomware 1 IoCs

Processes:

resource yara_rule

sample family_snatch
Snatch family
snatch

resource	yara_rule
sample	family_snatch

Files

852a1558ef3f4b0732cc991e7052bd1e346e27849bbd53bc2f37172a3490dc7a
.exe windows x64

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 281B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 40B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 469KB - Virtual size: 469KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 137KB - Virtual size: 444KB

/4 Size: 512B - Virtual size: 281B

/19 Size: 248KB - Virtual size: 247KB

/32 Size: 49KB - Virtual size: 48KB

/46 Size: 512B - Virtual size: 40B

/65 Size: 469KB - Virtual size: 469KB

/78 Size: 251KB - Virtual size: 250KB

/90 Size: 87KB - Virtual size: 86KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 54KB - Virtual size: 53KB

.symtab Size: 208KB - Virtual size: 208KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 137KB - Virtual size: 444KB

/4
Size: 512B - Virtual size: 281B

/19
Size: 248KB - Virtual size: 247KB

/32
Size: 49KB - Virtual size: 48KB

/46
Size: 512B - Virtual size: 40B

/65
Size: 469KB - Virtual size: 469KB

/78
Size: 251KB - Virtual size: 250KB

/90
Size: 87KB - Virtual size: 86KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 54KB - Virtual size: 53KB

.symtab
Size: 208KB - Virtual size: 208KB