Sibot Malware
Tags
attack-pattern: Malware - T1587.001 Malware - T1588.001 Rundll32 - T1218.011 Scheduled Task - T1053.005 Server - T1583.004 Server - T1584.004 Software - T1592.002 Visual Basic - T1059.005 Rundll32 - T1085 Scheduled Task - T1053
Show in Graph
Common Information
Type Value
UUID c88f76cd-8539-48b1-8cfa-83858ee62232
Fingerprint 3527998005315180
Analysis status DONE
Considered CTI value 1
Text language
Published Aug. 12, 2024, midnight
Added to db Aug. 31, 2024, 5:08 a.m.
Last updated Nov. 17, 2024, 6:54 p.m.
Headline Sibot Malware
Title Sibot Malware
Detected Hints/Tags/Attributes 29/1/5
Source URLs
Redirection Url
Details Source https://intel471.com/blog/sibot-malware
URL Provider
Details Provider Source level domain
Details intel471.com intel471.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 138 ✔ Intel471 https://intel471.com/blog/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details File 1 
c:\windows\system32\drivers\ and is modified to add a .sys
Details File 1018 
rundll32.exe
Details Mandiant Uncategorized Groups 97 
UNC2452
Details Windows Registry Key 2 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot
Details Windows Registry Key 2 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot