Get2Malware
- friendspeak
- getandgo
Get2 is a downloader written in C++ that has been used by TA505 to deliver FlawedGrace, FlawedAmmyy, Snatch and SDBbot.From MITRE ATT&CK
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1176.001Browser Extensions
“After the browser extensions are enumerated, there is a check for a hardcoded file titled hmr_*.dat inside the C:\ProgramData directory.”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic Security Labs discovers the LOBSHOT malware“A loader documented by Proofpoint, known as Get2, has also been tied to the same domains in the past that we observed with LOBSHOT.”
Indicators in its reports
named in the reports above- hxxps://www.amydecke[.]websitein 1 report
- www.amydecke[.]websitein 1 report
- e4ea88887753a936…e27991856bf6in 1 report
- 95.217.125[.]200in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/actor/ta505in 1 report
- hxxps://www.malware-traffic-analysis[.]net/2023/01/23/index.htmlin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.