General
- Target d02c61975e492ee85620d257f4a85f692522aab136cbd5827f9673b2e660c71c.exe
- Size 4.8MB
- Sample250827-178r8aypy8
- SHA256 d02c61975e492ee85620d257f4a85f692522aab136cbd5827f9673b2e660c71c
Score
10/10
Malware Config
Targets
-
- Target d02c61975e492ee85620d257f4a85f692522aab136cbd5827f9673b2e660c71c.exe
- Size 4.8MB
- SHA256 d02c61975e492ee85620d257f4a85f692522aab136cbd5827f9673b2e660c71c
Score10/10Detecting the common Go functions and variables names used by Snatch ransomware
Snatch Ransomware
Ransomware family generally distributed through RDP bruteforce attacks.
Snatch family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (9379) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.