IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE4 IOCs

Darktrace Malware Analysis: Unpacking Snappybee

OT
ORKL Threat Library
Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYBRONZE TIGEREarth EstriesFamousSparrowINFRASTRUCTUREtls.readthedocs.io/pr…CAPABILITYCobalt StrikeVICTIMunknown
Adversary(5)
Infrastructure(1)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise4

TypeIndicatorConfidenceScoreFirst Seen
SHA256b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac
file-hashloadermalware
High
67
Oct 10, 26
SHA2561a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296
file-hashloadermalware
High
67
Oct 10, 26
SHA25625b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
cryptominerfile-hashloader
High
67
Oct 10, 26
URLtls.readthedocs.io/projects/api/en/v2.28.4/api/file/arc4_8h/#_CPPv418mbedtls_arc4_cryptP20mbedtls_arc4_context6size_tPKhPh
exploitmalwarenetwork
High
67
Oct 10, 26

IOC Relationship Graph

IOC Relationship Graph4 total IOCs
SHA256URL
SHA2563URL1Actors5Malware1REPORTDarktrace Malware AnalysisBRONZE TIGEREarth EstriesFamousSparrowGhostEmperorSalt TyphoonCobalt Strike
scroll to zoom · drag to pan · click IOC to open