Sibot

Malware & Tools · Sibot

· MalwareS0589 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Sibot is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three Sibot variants in early 2021 during its investigation of APT29 and the SolarWinds Compromise.(Citation: MSTIC NOBELIUM Mar 2021)

Tactic Coverage

stealth (8)discovery (3)execution (3)command and control (3)persistence (2)privilege escalation (1)defense impairment (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (18)

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027.010Command Obfuscation

stealth

T1027.011Fileless Storage

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1047Windows Management Instrumentation

execution

T1049System Network Connections Discovery

References

https://attack.mitre.org/software/S0589 https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/