MITRE ATT&CKsoftware (malware)
S1086 Snip3
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2023-09-13
Description
Snip3 is a sophisticated crypter-as-a-service that has been used since at least 2021 to obfuscate and load numerous strains of malware including AsyncRAT, Revenge RAT, Agent Tesla, and NETWIRE.
Related
Uses · MITRE ATT&CK (20)
- T1564.003 Hidden Window sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1027.001 Binary Padding sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.012 Process Hollowing sub-technique
- T1189 Drive-by Compromise technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1027 Obfuscated Files or Information technique
- T1047 Windows Management Instrumentation technique
- T1082 System Information Discovery technique
- T1102 Web Service technique
- T1104 Multi-Stage Channels technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G1018 TA2541 group
References
- https://telefonicatech.com/blog/snip3-investigacion-malware Telefonica Snip3 December 2021
- https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader Morphisec Snip3 May 2021