saintbot

General

Target
b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
Size 269KB
Sample220228-dqzfwsedfn
SHA256 b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
MD5 e640bdb76d7b30cb9ca9250d5b6631e3
SHA1 0540792efa9eb7ecdcfce3340dc0be1204c1e8c8
SHA512 0d9bbc8f82a212cbb92595f2d5e7e4e1bab00061286f04441dce4c383827e3d55a60afee4e1d52b2af4ded201c5c54c046a4065ca055cfa1448b807a4a4a2034
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
- Size 269KB
- SHA256 b1af67bcfaa99c369960580f86e7c1a42fc473dd85a0a4d3b1c989a6bc138a42
- MD5 e640bdb76d7b30cb9ca9250d5b6631e3
- SHA1 0540792efa9eb7ecdcfce3340dc0be1204c1e8c8
- SHA512 0d9bbc8f82a212cbb92595f2d5e7e4e1bab00061286f04441dce4c383827e3d55a60afee4e1d52b2af4ded201c5c54c046a4065ca055cfa1448b807a4a4a2034
- MD5 SHA1 SHA512
Score

10^/10

saintbot discovery dropper persistence suricata
- SaintBot
  Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
  dropper saintbot
- SaintBot Payload
- Suspicious use of NtCreateProcessExOtherParentProcess
- suricata: ET MALWARE Saint Bot CnC Activity
  suricata: ET MALWARE Saint Bot CnC Activity
  suricata
- suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
  suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
  suricata
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2