Extracted

• • Target

    2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch

  • Size

    2.2MB

  • MD5

    61a8fc763aa8bfdb1e43001566bcfce7

  • SHA1

    b65880c2c590b3d2f736bf2818be923214a6efe5

  • SHA256

    8d797c2e404f3162c836020500b99c524deedabfc4770ee54fd9e0ea8bfd2ef4

  • SHA512

    5c39fb96e97dd7291b55b3d16ca0b0521e391369aa639801054e1011b11b3680ec2374dac8b2447677a23bf480c4b2014bb90442f0e8afe1b298c08650d14823

  • SSDEEP

    24576:lm8bqgR8VT8P5ZmUbFJnDoaY3azzKSP/OFvIxJH92ZK86EqDh8YCJjiraf4oAV/j:v73h3P/4K81TjasiXCUVnjU1HO1

  Score

  10^/10

  hivecredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealerpersistence

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2