General
- Target b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
- Size 269KB
- Sample220228-dqzfwsedfn
- SHA256 b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
Score
10/10
Malware Config
Targets
-
- Target b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
- Size 269KB
- SHA256 b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
Score10/10SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
SaintBot Payload
Suspicious use of NtCreateProcessExOtherParentProcess
suricata: ET MALWARE Saint Bot CnC Activity
suricata: ET MALWARE Saint Bot CnC Activity
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
Executes dropped EXE
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Deletes itself
Drops startup file
Loads dropped DLL
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Drops file in System32 directory