Snip3

ATP Sandbox Adv. Heuristics

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

20 techniques across 6 tactics.

TA0001 Initial Access

T1189Drive-by Compromise
T1566Phishing
- T1566.001Spearphishing Attachment
- T1566.002Spearphishing Link

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
- T1059.001PowerShell
T1204User Execution
- T1204.002Malicious File
- T1204.001Malicious Link

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.001Binary Padding
T1055Process Injection
- T1055.012Process Hollowing
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks
- T1497.001System Checks
T1564Hide Artifacts
- T1564.003Hidden Window

TA0007 Discovery

T1082System Information Discovery

TA0011 Command and Control

T1102Web Service
T1104Multi-Stage Channels
T1105Ingress Tool Transfer

Associated groups

G1018TA2541

Alert name variants

Alert Name	Engine
Script-PowerShell.Trojan.Snip3	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Snip3	ATP Sandbox Adv. Heuristics

Related families

QakBot Bumblebee DarkGate Latrodectus Bazar