snatch | 0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb

Sharing

Copy URL Twitter E-mail

General

Target
0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb
Size 4.0MB
Sample230418-lfvc7acd4z
SHA256 0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb
MD5 29738dd9b52dcd61cd791b6d805929c1
SHA1 b226a60f03c7036f6bcbce400ad40ebe7f527925
SHA512 fcf8b789a36f90414034a131c6ba872a547d03025fd29aaf48779ea154aee02def7234f4c17dcec5b0f9bcd26cdce34b257979872c0b44d1c4bcafa9a42ac65b
SSDEEP 49152:1gZNP3LGVfMmq1d1MRGM8Fvg9fR5xMXF9WzHrAbluBUMNk+cqG2UtBpStPvC/9fu:1gXDMfql+929+B+tBpEPvCF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snatch

Malware Config

Signatures

Detecting the common Go functions and variables names used by Snatch ransomware 1 IoCs

resource	yara_rule
sample	family_snatch

Snatch family
snatch

File Explorer

0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb

.exe 4.0MB

0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb

IMPHASH f0070935b15a909b9dc00be7997e6112
SHA256 0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb
MD5 29738dd9b52dcd61cd791b6d805929c1
SHA1 b226a60f03c7036f6bcbce400ad40ebe7f527925
SHA512 fcf8b789a36f90414034a131c6ba872a547d03025fd29aaf48779ea154aee02def7234f4c17dcec5b0f9bcd26cdce34b257979872c0b44d1c4bcafa9a42ac65b
SSDEEP 49152:1gZNP3LGVfMmq1d1MRGM8Fvg9fR5xMXF9WzHrAbluBUMNk+cqG2UtBpStPvC/9fu:1gXDMfql+929+B+tBpEPvCF
MD5 SHA1 SHA512 SSDEEP

windows x86

Detecting the common Go functions and variables names used by Snatch ransomware

Minor OS version

Major OS version

Entry point

321648

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

102KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

281B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

205KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/63

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

34B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/99

Size

445KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/112

Size

247KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/124

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

786B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.symtab

Size

257KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb

kernel32