Palo Alto Unit 42 OutSteel SaintBot February 2022

OutSteel can collect information from a compromised host.

OutSteel can automatically upload collected files to its C2 server.

Saint Bot has been obfuscated to help avoid detection.

Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.

Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.

Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.

OutSteel attempts to download and execute Saint Bot to a statically-defined location attempting to mimic svchost: %TEMP%\\svjhost.exe.

OutSteel can upload files from a compromised host over its C2 channel.

The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.

OutSteel can identify running processes on a compromised host.

Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.

Saint Bear has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.

Saint Bear relies extensively on PowerShell execution from malicious attachments and related content to retrieve and execute follow-on payloads.

Saint Bot has used PowerShell for execution.

Saint Bot has used `cmd.exe` and `.bat` scripts for execution.

OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.

Saint Bear initial loaders will also drop a malicious Windows batch file, available via open source GitHub repositories, that disables Microsoft Defender functionality.

Saint Bot has used `.vbs` scripts for execution.

Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.

OutSteel was developed using the AutoIT scripting language.

OutSteel can delete itself following the successful execution of a follow-on payload.

Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.

OutSteel has used HTTP for C2 communications.

OutSteel can search for specific file extensions, including zipped files.

Saint Bot can search a compromised host for specific files.

Saint Bot can download additional files onto a compromised host.

OutSteel can download files from its C2 server.

Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.

Saint Bear will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.

OutSteel can automatically scan for and collect files with specific extensions.

Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.

Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.

Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.

OutSteel has relied on a user to click a malicious link within a spearphishing email.

Saint Bot has relied on users to execute a malicious attachment delivered via spearphishing.

OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.

Saint Bear relies on user interaction and execution of malicious attachments and similar for initial execution on victim systems.

Saint Bot has used `regsvr32` to execute scripts.

Saint Bear contains several anti-analysis and anti-virtualization checks.

Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.

Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.

Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.

Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges.

Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."

Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.

OutSteel has been distributed as a malicious attachment within a spearphishing email.

Saint Bot has been distributed as malicious attachments within spearphishing emails.

OutSteel has been distributed through malicious links contained within spearphishing emails.

Saint Bot has been distributed through malicious links contained within spearphishing emails.

OutSteel can download the Saint Bot malware for follow-on execution.