H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Get2

[Get2](https://attack.mitre.org/software/S0460) is a downloader written in C++ that has been used by [TA505](https://attack.mitre.org/groups/G0092) to deliver [FlawedGrace](https://attack.mitre.org/software/S0383), [FlawedAmmyy](https://attack.mitre.org/software/S0381), Snatch and [SDBbot](https://attack.mitre.org/software/S0461).(Citation: Proofpoint TA505 October 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Get2](https://attack.mitre.org/software/S0460) is a downloader written in C++ that has been used by [TA505](https://attack.mitre.org/groups/G0092) to deliver [FlawedGrace](https://attack.mitre.org/software/S0383), [FlawedAmmyy](https://attack.mitre.org/software/S0381), Snatch and [SDBbot](https://attack.mitre.org/software/S0461).(Citation: Proofpoint TA505 October 2019)

Labels

malware
7 recorded

Relationships

uses
to Command and Scripting Interpreter
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to Process Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
from TA505
Group
2 external

References

mitre-attack
S0460
open
Proofpoint TA505 October 2019
https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance