Log in Request a demo

Ransomware

[Research Summary]: Snatch Ransomware

Snatch ransomware reboots into Safe Mode to bypass default safeguards, then encrypts files. See how it works, its sample hashes and MITRE ATT&CK mapping.

Brandefense logo Updated 2 Min Read
snatch ransomware explained by brandefense

Snatch ransomware is a ransomware-as-a-service (RaaS) threat that reboots a computer into Safe Mode before encrypting files, so that many default protections are not running. CISA also reports that it tries to delete all volume shadow copies to block recovery. This post summarizes one analyzed Snatch sample, its file hashes and its MITRE ATT&CK techniques.

This blog post comes from the “Snatch Ransonware Technical Analysis Report” by the Brandefense Research Team. For more details about the analysis, download the report.

What Is Snatch Ransomware?

Snatch ransomware is a variant of ransomware developed using the Go programming language in this sample. It first appeared in 2018 and was offered as a ransomware-as-a-service (RaaS). Instead of encrypting files directly, it initiates a system reboot, forcing the computer into Safe Mode. Once in Safe Mode, many default safeguards are disabled, allowing the ransomware to encrypt data. It uses common packers such as UPX to hide its payload.

Overview

File Name: bf5f4d7b6ef1fdb903677e4ede04fb49952e08cee79822b9b53642bb5d1e6f02.exe
MD5: cfd31737ccacf6e9a0e2ac18cf3445ac
SHA-1: 74c615ca54aaff3c5e6734efef04259290c357ba
SHA256: bf5f4d7b6ef1fdb903677e4ede04fb49952e08cee79822b9b53642bb5d1e6f02

Conclusion

In summary, Snatch Ransomware stands out as a malicious software variant that poses a substantial menace to computer systems and data security. What distinguishes Snatch from other ransomware is its unique approach, which involves leveraging Safe Mode to bypass default safeguards, eliminating volume shadow copies to impede system recovery, and generating random batch files for execution.

All in all, Snatch Ransomware underscores the evolving and sophisticated nature of ransomware threats, underscoring the significance of robust cybersecurity practices, routine data backups, and proactive measures to thwart infection and mitigate potential repercussions stemming from such attacks.

Which MITRE ATT&CK Techniques Does Snatch Use?

  1. TA0002 Execution
    • T1059 Command and Scripting Interpreter (formerly T1064, Scripting)
  2. TA0004 Privilege Escalation
    • T1055 Process Injection
  3. TA0005 Stealth
    • T1027 Obfuscated Files or Information
    • T1036 Masquerading
  4. TA0007 Discovery
    • T1082 System Information Discovery
    • T1614 System Location Discovery
  5. TA0009 Collection
    • T1005 Data From Local System

Download YARA Rules from GitHub.

This blog post comes from the “Snatch Ransomware Technical Analysis Report” by the Brandefense Research Team. For more details about the analysis, download the report.

Frequently Asked Questions.

What is Snatch ransomware?

Snatch is ransomware offered as a service (RaaS). CISA says it first appeared in 2018. It is known for rebooting devices into Safe Mode before encrypting files.

Why does Snatch reboot into Safe Mode?

CISA says this helps it get around detection by antivirus or endpoint protection, because few services are running when the files are encrypted. The post adds that many default safeguards are disabled in Safe Mode.

Does Snatch delete backups or shadow copies?

Yes. CISA says Snatch attempts to remove all volume shadow copies from a system, and the post says this impedes system recovery.

Does Snatch use batch files?

Yes. CISA says Snatch uses batch files (.bat) during ransomware execution and data discovery. The post says it generates random batch files.

How can you reduce the risk from Snatch ransomware?

The post recommends strong cybersecurity practices, routine data backups and proactive measures to stop infection and limit the effects of an attack.

Sources

  1. 1 CISA and FBI: #StopRansomware: Snatch Ransomware (AA23-263A)
  2. 2 MITRE ATT&CK: Stealth tactic (TA0005)
  3. 3 MITRE ATT&CK: T1064 Scripting
Share

In This Article

TechniquesCommand and Scripting Interpreter TechniquesProcess Injection TechniquesObfuscated Files or Information TechniquesMasquerading TermsMITRE ATT&CK TermsRansomware TermsMalware TermsPrivilege escalation

Where To Next.

All Ransomware Articles
In plain words · Glossary term MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Open → Keep reading · Article [Research Summary]: Mystic Stealer

Mystic Stealer is a stealer malware that first surfaced in April 2023.

Open → Keep reading · Article Echida Stealer Technical Analysis

Echida Stealer is a C# malware that steals data and takes remote commands.

Open →

Knowledge HubRansomware groups