snatch | 81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a | Triage

Submit
Reports

Overview

overview

Static

static

81b79660be...7a.exe

windows7-x64

81b79660be...7a.exe

windows10-2004-x64

Sharing

General

Target

81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a
Size

5.0MB
Sample

221130-w8kpkagh8v
MD5

6b114c9e97ef3ff022b51a6e0f6b32af
SHA1

92979adf9ca1180cf7c39cb7a02641f7b4e1eff0
SHA256

81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a
SHA512

065cb4bd68bafae39c1c420eaed314def3a7ecff9dddcc5c5ebb0c34c8ad8fb2a3c6ee50c18e6b025da4666210a77384ca6f175dff26061dfbc2a71a981a4466
SSDEEP

98304:7ExhIKfP5bW1gDaogfd9xkGmBjEQX1DXi5VJUsUyuW/Du3TZyZ1GPY:4xhI0P5bW1g+nfHxkGmBjEQX1DXiJUsx

Score

10^/10

snatch ransomware spyware stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a.exe

Resource

win7-20220812-en

snatch ransomware spyware stealer upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a.exe

Resource

win10v2004-20221111-en

snatch ransomware upx

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a
- Size
  
  5.0MB
- MD5
  
  6b114c9e97ef3ff022b51a6e0f6b32af
- SHA1
  
  92979adf9ca1180cf7c39cb7a02641f7b4e1eff0
- SHA256
  
  81b79660be9fc60338eb69eaab2e0b9cfdc750fc5a7e05dabb50a3d45a993b7a
- SHA512
  
  065cb4bd68bafae39c1c420eaed314def3a7ecff9dddcc5c5ebb0c34c8ad8fb2a3c6ee50c18e6b025da4666210a77384ca6f175dff26061dfbc2a71a981a4466
- SSDEEP
  
  98304:7ExhIKfP5bW1gDaogfd9xkGmBjEQX1DXi5VJUsUyuW/Du3TZyZ1GPY:4xhI0P5bW1g+nfHxkGmBjEQX1DXiJUsx
Score

10^/10

snatch ransomware spyware stealer upx
- Detecting the common Go functions and variables names used by Snatch ransomware
- Snatch Ransomware
  Ransomware family generally distributed through RDP bruteforce attacks.
  ransomware snatch
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

snatchransomwarespywarestealerupx

behavioral2

snatchransomwareupx

© 2018-2024

Terms | Privacy