MITRE ATT&CKsoftware (malware)
S1200 StealBit
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2025-01-29
Description
StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.
Related
Uses · MITRE ATT&CK (15)
- T1685 Disable or Modify Tools technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1622 Debugger Evasion technique
- T1614.001 System Language Discovery sub-technique
- T1071.001 Web Protocols sub-technique
- T1559 Inter-Process Communication technique
- T1070.004 File Deletion sub-technique
- T1480 Execution Guardrails technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1030 Data Transfer Size Limits technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1106 Native API technique
References
- https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool Cybereason StealBit Exfiltration Tool
- https://www.ic3.gov/CSA/2022/220204.pdf FBI Lockbit 2.0 FEB 2022