Get2
MITRE ATT&CK: S0460 View on attack.mitre.org
Aliases: FRIENDSPEAK, GetandGo, Get2
- First seen
- 2019-06-01 00:00:00
- Malware type
- downloader
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 98 (11 malicious)
- Last IoC activity
- 2026-10-17 17:17:47
- Profile updated
- 2026-07-07 12:41:18
Targeted industries: financial-services retail-and-hospitality technology-and-telecommunications
Context
Get2 is a downloader written in C++ that has been used by TA505 to deliver FlawedGrace, FlawedAmmyy, Snatch and SDBbot.
Recent IoC activity
11 malicious indicators in Maltiverse are attributed to Get2 (S0460). The 11 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| IP address | 5.134.122.237 | 2026-10-14 | 6 |
| hostname | www.epower-adv.it | 2026-10-06 | 1 |
| URL | http://reachtherapyllc.com/1q0hts9.html | 2026-01-01 | 1 |
| file sample | P002983_37478.xls | 2025-12-27 | 1 |
| URL | http://gmy.su/:jjOab | 2025-11-14 | 1 |
| URL | http://ntskeptics.org/ukpg.html | 2025-11-11 | 1 |
| URL | http://4sv.xyz/advertisment.php | 2025-10-19 | 1 |
| URL | http://gmy.su/:jlOab | 2025-10-02 | 1 |
| file sample | 32286ed3acc2ab1145b88677ae0924fbe4c39d5156d5dfe5985275d0a01f732f | 2025-09-30 | 1 |
| URL | http://mosgid.ru/~mosgid/u4mt.html | 2025-09-22 | 1 |
| URL | http://www.epower-adv.it/wounding.php | 2025-07-17 | 1 |
Detection coverage
- 1 YARA rules
- 177 Sigma rules
Malware & tools used
- Dynamic-link Library Injection (attack-pattern)
- Process Discovery (attack-pattern)
- System Information Discovery (attack-pattern)
- Command and Scripting Interpreter (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Web Protocols (attack-pattern)
Used by threat actors
- TA505 (threat-actor)
Detection rules
- MALPEDIA_Win_Get2_Auto (yara-rule)
Reports & references
- pwc.co.uk — Cyber Threats 2019 Retrospect (report)
- blog.intel471.com — A Brief History Of Ta505 (report)
- intel471.com — A Brief History Of Ta505 (report)
- ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
- CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
- proofpoint.com — Ta505 Distributes New Sdbbot Remote Access Trojan Get2 Downloader (report)
- telekom.com — Cybersecurity Ta505 S Box Of Chocolate 597672 (report)
- telekom.com — Cybersecurity Ta505 Returns With A New Bag Of Tricks 602104 (report)
- secureworks.com — Gold Tahoe (report)
- telekom.com — Eager Beaver A Short Overview Of The Restless Threat Actor Ta505 609546 (report)
- blog.fox-it.com — Ta505 A Brief History Of Their Time (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 009 (report)
- hornetsecurity.com — Clop Clop Ta505 Html Malspam Analysis (report)
- telekom.com — Inside Of Cl0P S Ransomware Operation 615824 (report)
- github.com — Tafof Unpacker (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 006 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Get2 (report)
- intel471.com — Ta505 Get2 Loader Malware December 2020 (report)
- github.com — Malware%20Analysis%2004 10 2019.Md (report)
- elis531989.medium.com — Funtastic Packers And Where To Find Them 41429A7Ef9A7 (report)
- blog.intel471.com — Flowspec Ta505S Bulletproof Hoster Of Choice (report)
- goggleheadedhacker.com — 13 (report)
- MITRE ATT&CK — S0460 (report)
- proofpoint.com — Coronavirus Threat Landscape Update (report)