Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-10-2024 10:02
General
-
Target
2024-10-15_6d80b3e76099d049c5008a23d38936ab_snatch.exe
-
Size
2.6MB
-
MD5
6d80b3e76099d049c5008a23d38936ab
-
SHA1
3b47d5fc476349dfd33594d1647610925d863151
-
SHA256
bbf0e161b87265e5f10ca226f1188eb6ce157acb7c2aac6ad56367058e86f5fb
-
SHA512
3305b4818b4a1ec6e8b8d1c479f4da68d35af98aae043b43eb59f45d4a1bc301b337cd542feb6d12c9ecd7365cde70885233469092bf5afc87dc3f9195cbed95
-
SSDEEP
24576:t4ybxkJlcXgszkiwIm9seW6sCtTlXc/ut5Mdrp7hSgsuLu5RPVeVbV2qK7zAq/Gm:r6cQsoBISsB/LujVDAB/X+
Malware Config
Signatures
-
Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
-
Zebrocy Go Variant 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-15_6d80b3e76099d049c5008a23d38936ab_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-15_6d80b3e76099d049c5008a23d38936ab_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
-
Filesize
2.7MB