SnatchMalware
Snatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protections do not run in Safe Mode so that it the malware can act without expected countermeasures and it can encrypt as many files as it finds. It uses common packers such as UPX to hide its payload.From MISP Galaxy
Last reported 2 months ago, by Infosecurity Magazine2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“The attacker then accessed the domain controller via Remote Desktop Protocol (RDP) and began Active Directory (AD) enumeration, following a similar playbook to many Akira attacks, Huntress explained.”
- T1688Safe Mode Boot
“This is a common approach for ransomware actors; in fact, it is listed by MITRE ATT&CK (T1688) as “Impair Defences: Safe Mode Boot.” Although not spotted in relation to Akira previously, the technique has been associated with groups like Snatch and AvosLocker “for years,” Huntres…”
- T1018Remote System Discovery
“Active Directory enumeration output (T1087/T1018)”
- T1087Account Discovery
“Active Directory enumeration output (T1087/T1018)”
- T1560.001Archive via Utility
“Collection — archive of file shares (T1560.001)”
- T1567.002Exfiltration to Cloud Storage
“Exfiltration to attacker S3 bucket (T1567.002)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Akira Affiliate Crashes Ransomware After Attempting EDR Evasion“…pair Defences: Safe Mode Boot.” Although not spotted in relation to Akira previously, the technique has been associated with groups like Snatch and AvosLocker “for years,” Huntress claimed.”
-
Akira Hits Safe Mode: Ransomware Rebooting Around EDR“Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.”
Indicators in its reports
named in the reports above- 72.23.77[.]35in 1 report
- e2356c742c74cce5…061a95b3299ain 1 report
- 414b9985f46714f4…575378127a56in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.