Procedure examples

Sibot has queried the registry for proxy server information.

Sibot checked if the compromised system is configured to use proxies.

Sibot has obfuscated scripts used in execution.

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.

Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.

Sibot has been executed via a scheduled task.

Sibot executes commands using VBScript.

Sibot will delete an associated registry key if a certain server response is received.

Sibot will delete itself if a certain server response is received.

Sibot communicated with its C2 server via HTTP GET requests.

Sibot has used a legitimate compromised website to download DLLs to the victim's machine.

Sibot can download and execute a payload onto a compromised system.

Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.

Sibot can decrypt data received from a C2 and save to a file.

Sibot has been executed via MSHTA application.

Sibot has executed downloaded DLLs with rundll32.exe.