Malwarebytes Saint Bot April 2021

Saint Bot can collect files and information from a compromised host.

Saint Bot has used `check_registry_keys` as part of its environmental checks.

Saint Bot can collect the IP address of a victim machine.

Saint Bot has been packed using a dark market crypter.

Saint Bot can collect the username from a compromised host.

Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.

Saint Bot has been disguised as a legitimate executable, including as Windows SDK.

Saint Bot has created a scheduled task named "Maintenance" to establish persistence.

Saint Bot has injected its DLL component into `EhStorAurhn.exe`.

Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.

Saint Bot has used HTTP for C2 communications.

Saint Bot can identify the OS version, CPU, and other details from a victim's machine.

Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.

Saint Bot has used Base64 to encode its C2 communications.

Saint Bot can deobfuscate strings and files for execution.

Saint Bot has relied on users to execute a malicious attachment delivered via spearphishing.

Saint Bot had used `InstallUtil.exe` to download and deploy executables.

Saint Bot has used `regsvr32` to execute scripts.

Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.

Saint Bot has been distributed as malicious attachments within spearphishing emails.

Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.

Saint Bot has used `is_debugger_present` as part of its environmental checks.