Overview

overview

10

Static

static

def7ee7370...5d.exe

windows7-x64

10

def7ee7370...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    def7ee73702c5d8783694e9eb431af4b7a3d172d1939e38dd472faf5559b355d

  • Size

    7.6MB

  • Sample

    221207-m5xqaaaf94

  • MD5

    f837a294b2fc311996a0a9f17cfac49c

  • SHA1

    f16df5bc0d0e8a4283dbcc782bc8a7128784f673

  • SHA256

    def7ee73702c5d8783694e9eb431af4b7a3d172d1939e38dd472faf5559b355d

  • SHA512

    1277c4295d269a1aafcec93878b007af7da1b8dbb898fbb43d4e045a558a1cf3fde3317888799d6e8ab698df1aec1a42e90f51115a4f335918728305145430fb

  • SSDEEP

    196608:APuSeJVfq2xiQzLV/5Tcza6T/91VEwmVdx0iT/n6Ko:A2S0iIiWRuV1vir6K

Score
10/10
snatchransomwarespywarestealer

Malware Config

Targets

    • Target

      def7ee73702c5d8783694e9eb431af4b7a3d172d1939e38dd472faf5559b355d

    • Size

      7.6MB

    • MD5

      f837a294b2fc311996a0a9f17cfac49c

    • SHA1

      f16df5bc0d0e8a4283dbcc782bc8a7128784f673

    • SHA256

      def7ee73702c5d8783694e9eb431af4b7a3d172d1939e38dd472faf5559b355d

    • SHA512

      1277c4295d269a1aafcec93878b007af7da1b8dbb898fbb43d4e045a558a1cf3fde3317888799d6e8ab698df1aec1a42e90f51115a4f335918728305145430fb

    • SSDEEP

      196608:APuSeJVfq2xiQzLV/5Tcza6T/91VEwmVdx0iT/n6Ko:A2S0iIiWRuV1vir6K

    Score
    10/10
    snatchransomwarespywarestealer

    • Detecting the common Go functions and variables names used by Snatch ransomware

    • Snatch Ransomware

      Ransomware family generally distributed through RDP bruteforce attacks.

      ransomwaresnatch

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks