TF-MAL-elf.spawnsnare
📛 Threat Title
Malware family: SPAWNSNARE
Description
ThreatFox malware family `elf.spawnsnare`. Printable name: SPAWNSNARE.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.spawnsnare
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.spawnsnare
IOC database
- Type
- domain
- Value
elf.spawnsnare- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.spawnsnare
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.spawnsnare
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:1898advisories.burnsmcd.com
Recent cybersecurity developments have highlighted the active exploitation of a critical zero-day vulnerability in Ivanti Connect Secure (ICS) appliances, identified as CVE-2025-0282. This vulnerability, with a CVSS score of 9.0, allows unauthenticated remote code execution, posing a significant threat to network security.
-
web:cloud.google.com
In addition, Ivanti released a new enhanced external integrity checker tool (ICT) to detect potential attempts of malware persistence across factory resets and system upgrades and other tactics, techniques, and procedures (TTPs) observed in the wild. We also released a remediation and hardening guide, which includes recommendations.
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:cyberpress.org
Removal of Debug Messages Another notable modification in SPAWNCHIMERA is the removal of debug messages present in earlier versions of the malware family . This adjustment appears aimed at hindering malware analysis and reducing opportunities for cybersecurity professionals to identify behavioral patterns.
-
web:cybersecuritynews.com
Mitigation Measures Ivanti has released patches addressing CVE-2025-0282 and recommends immediate application to all affected appliances, including Ivanti Connect Secure versions prior to 22.7R2.5. The emergence of SPAWNCHIMERA underscores the growing sophistication of malware targeting enterprise-grade VPN solutions.
-
web:hivepro.com
#4 Alongside DslogdRAT, another malware family called SPAWNSNARE was also detected on the same compromised systems. The DslogdRAT malware illustrates how attackers' pair simple web shells with more sophisticated RATs to maintain persistence and control over compromised devices, highlighting the need for comprehensive security measures.
-
web:malpedia.caad.fkie.fraunhofer.de
SPAWNSNARE Propose Change According to Mandiant, this is a utility that is written in C and targets Linux. It can be used to extract the uncompressed linux kernel image (vmlinux) into a file and encrypt it using AES without the need for any command line tools.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.