H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Saint Bot

[Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Labels

malware
39 recorded

Relationships

uses
from Ember Bear
Group
uses
from Saint Bear
Group
uses
to Asynchronous Procedure Call
Technique
uses
to Bypass User Account Control
Technique
uses
to Data from Local System
Technique
uses
to Debugger Evasion
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Hijack Execution Flow
Technique
uses
to Ingress Tool Transfer
Technique
uses
to InstallUtil
Technique
uses
to Malicious File
Technique
uses
to Malicious Link
Technique
uses
to Masquerading
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Native API
Technique
uses
to Obfuscated Files or Information
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Process Hollowing
Technique
uses
to Query Registry
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Regsvr32
Technique
uses
to Scheduled Task
Technique
uses
to Software Packing
Technique
uses
to Spearphishing Attachment
Technique
uses
to Spearphishing Link
Technique
uses
to Standard Encoding
Technique
uses
to System Checks
Technique
uses
to System Information Discovery
Technique
uses
to System Location Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Time Based Checks
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
S1018
open
Malwarebytes Saint Bot April 2021
https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/
open
Palo Alto Unit 42 OutSteel SaintBot February 2022
https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance