SDBbotMalware
SDBbot is a backdoor with installer and loader components that has been used by TA505 since at least 2019.From MITRE ATT&CK
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1003OS Credential Dumping
“T1003”
- T1007System Service Discovery
“T1007”
- T1018Remote System Discovery
“T1018”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1021.004SSH
“T1021.004”
- T1027Obfuscated Files or Information
“T1027”
What the reports say
1 report, newest first · the exact sentence from each-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“…le loader code has been observed in two other malware families, namely the banking Trojan KrBanker / BlackMoon and the TA505-related bot SDBbot.”
Indicators in its reports
named in the reports above- 4874d336c5c7c2f5…61ce9c38b86din 1 report
- 2fd264f58ba82a26…071f67bb67abin 1 report
- 03c41019faf7e4cc…4a20256c1813in 1 report
- 88081a21e500e831…b18a022f25bein 1 report
- aa48acaef62a7bfb…9a78864eb31fin 1 report
- b99d114b267ffd06…974bbce75bf2in 1 report
- 66bcad0829a59c42…bf65f13f3dc6in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.