s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

TF-MAL-elf.spawnsnare

📛 Threat Title

Malware family: SPAWNSNARE

Category: SPAWNSNARE First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `elf.spawnsnare`. Printable name: SPAWNSNARE.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain elf.spawnsnare VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.spawnsnare

IOC database

Type
domain
Value
elf.spawnsnare
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-elf.spawnsnare

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.spawnsnare

References (1)

Remediations (10)

  • web:1898advisories.burnsmcd.com

    Recent cybersecurity developments have highlighted the active exploitation of a critical zero-day vulnerability in Ivanti Connect Secure (ICS) appliances, identified as CVE-2025-0282. This vulnerability, with a CVSS score of 9.0, allows unauthenticated remote code execution, posing a significant threat to network security.

  • web:cloud.google.com

    In addition, Ivanti released a new enhanced external integrity checker tool (ICT) to detect potential attempts of malware persistence across factory resets and system upgrades and other tactics, techniques, and procedures (TTPs) observed in the wild. We also released a remediation and hardening guide, which includes recommendations.

  • web:cybernews.com

    The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.

  • web:cyberpress.org

    Removal of Debug Messages Another notable modification in SPAWNCHIMERA is the removal of debug messages present in earlier versions of the malware family . This adjustment appears aimed at hindering malware analysis and reducing opportunities for cybersecurity professionals to identify behavioral patterns.

  • web:cybersecuritynews.com

    Mitigation Measures Ivanti has released patches addressing CVE-2025-0282 and recommends immediate application to all affected appliances, including Ivanti Connect Secure versions prior to 22.7R2.5. The emergence of SPAWNCHIMERA underscores the growing sophistication of malware targeting enterprise-grade VPN solutions.

  • web:hivepro.com

    #4 Alongside DslogdRAT, another malware family called SPAWNSNARE was also detected on the same compromised systems. The DslogdRAT malware illustrates how attackers' pair simple web shells with more sophisticated RATs to maintain persistence and control over compromised devices, highlighting the need for comprehensive security measures.

  • web:malpedia.caad.fkie.fraunhofer.de

    SPAWNSNARE Propose Change According to Mandiant, this is a utility that is written in C and targets Linux. It can be used to extract the uncompressed linux kernel image (vmlinux) into a file and encrypt it using AES without the need for any command line tools.

  • web:www.breachsense.com

    Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  • web:www.cisa.gov

    It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  • web:www.ncsc.gov.uk

    How to defend organisations against malware or ransomware attacks.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.