General
- Target JaffaCakes118_eadc8b44e46603f78b5f84ad3ea350b71c5c32f0daf0f1d9cd978de2c7a76b78
- Size 3.9MB
- Sample241222-db2mps1kdk
- SHA256 eadc8b44e46603f78b5f84ad3ea350b71c5c32f0daf0f1d9cd978de2c7a76b78
Score
10/10
Malware Config
Targets
-
- Target 9361a5a13c26bdba1ce006356706339272465f4fa25c75a008f0041b9b647b90
- Size 4.0MB
- SHA256 9361a5a13c26bdba1ce006356706339272465f4fa25c75a008f0041b9b647b90
Score10/10-
SaintBot
Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
-
SaintBot payload
-
Saintbot family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1