1. Home
  2. Software
  3. Get2

Get2

Get2 is a downloader written in C++ that has been used by TA505 to deliver FlawedGrace, FlawedAmmyy, Snatch and SDBbot.[1]

ID: S0460
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 29 May 2020
Last Modified: 16 June 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Get2 has the ability to use HTTP to send information collected from an infected host to C2.[1]
Enterprise T1059 Command and Scripting Interpreter

Get2 has the ability to run executables with command-line arguments.[1]
Enterprise T1057 Process Discovery

Get2 has the ability to identify running processes on an infected host.[1]
Enterprise T1055 .001 Process Injection: Dynamic-link Library Injection

Get2 has the ability to inject DLLs into processes.[1]
Enterprise T1082 System Information Discovery

Get2 has the ability to identify the computer name and Windows version of an infected host.[1]
Enterprise T1033 System Owner/User Discovery

Get2 has the ability to identify the current username of an infected host.[1]

Groups That Use This Software

ID Name References
G0092 TA505

[1]

References

  1. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.