b75208393fa17c0bcbc1a07857686b8c0d7e0471d00a167a07fd0d52e1fc9054

Small Sieve NSIS installer 'gram_app.exe' analyzed by NCSC-UK and published in Appendix B of CISA AA22-055A. Drops the Python-based Telegram-Bot-API backdoor index.exe and persists via the registry Run key OutlookMicrosift.

family

Small Sieve

first seen

Feb 23, 2022

publisher

CISA