Procedure examples

Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.

Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.

Saint Bear has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.

Saint Bear relies extensively on PowerShell execution from malicious attachments and related content to retrieve and execute follow-on payloads.

Saint Bear initial loaders will also drop a malicious Windows batch file, available via open source GitHub repositories, that disables Microsoft Defender functionality.

Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.

Saint Bear will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.

Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.

Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.

Saint Bear relies on user interaction and execution of malicious attachments and similar for initial execution on victim systems.

Saint Bear contains several anti-analysis and anti-virtualization checks.

Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."

Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.

Saint Bear has leveraged the Discord content delivery network to host malicious content for retrieval during initial access operations.

Saint Bear gathered victim email information in advance of phishing operations for targeted attacks.

Saint Bear has used the Discord content delivery network for hosting malicious content referenced in links and emails.

Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.

Saint Bear will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.