Get2

Get2 is a type of malware, harmful software designed to infiltrate and damage computer systems or devices. It can be unknowingly downloaded through suspicious emails, downloads, or websites, enabling it to steal personal information, disrupt operations, or hold data hostage for ransom. Among the most frequently observed loaders of such malware are Bazar, Buer, Dridex, Get2, IcedID, and Qakbot. In particular, Get2 has been used as a dropper to download other types of malware such as SDBot and FlawedGrace. In 2019, threat actors known as TA505 leveraged a type of ransomware called CL0P as the final payload of a phishing campaign. This campaign involved the use of a macro-enabled document that utilized Get2 as a malware dropper for downloading SDBot and FlawedGrace. Serving the Get2 payload was particularly noticeable in October 2019, with TA505 targeting a wide range of verticals and regions, indicating their consistent behavioral pattern of "following the money." The Get2 downloader, combined with SDBbot as its payload, appears to be TA505's latest strategy during the Fall of 2019. Proofpoint researchers speculate that the reboot functionality in the Get2 downloader is used to continue SDBbot’s execution after installation in the TA505 campaigns. SDBbot is a new remote access Trojan (RAT) written in C++ that has been delivered by the Get2 downloader in recent TA505 campaigns.