Skip to content

Hide Navigation Hide TOC

StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf)

StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.(Citation: Cybereason StealBit Exfiltration Tool)(Citation: FBI Lockbit 2.0 FEB 2022)

Cluster A Galaxy A Cluster B Galaxy B Level
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Non-Application Layer Protocol - T1095 (c21d5a77-d422-4a69-acd7-2c53c1faa34b) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Data Transfer Size Limits - T1030 (c3888c54-775d-4b2f-b759-75a2ececcbfd) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Indicator Blocking - T1562.006 (74d2a63f-3c7b-4852-92da-02d8fbab16da) Attack Pattern 1
Inter-Process Communication - T1559 (acd0ba37-7ba9-4cc5-ac61-796586cd856d) Attack Pattern StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Debugger Evasion - T1622 (e4dc8c01-417f-458d-9ee0-bb0617c1b391) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) Attack Pattern 1
Execution Guardrails - T1480 (853c4192-4311-43e1-bfbb-b11b14911852) Attack Pattern StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware System Language Discovery - T1614.001 (c1b68a96-3c48-49ea-a6c0-9b27359f9c19) Attack Pattern 1
StealBit - S1200 (cf8b27df-c494-4a0c-b093-556a80ad2bcf) Malware File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c) Attack Pattern 1
Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern Indicator Blocking - T1562.006 (74d2a63f-3c7b-4852-92da-02d8fbab16da) Attack Pattern 2
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern 2
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144) Attack Pattern 2
System Location Discovery - T1614 (c877e33f-1df6-40d6-b1e7-ce70f16f4979) Attack Pattern System Language Discovery - T1614.001 (c1b68a96-3c48-49ea-a6c0-9b27359f9c19) Attack Pattern 2
Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69) Attack Pattern File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c) Attack Pattern 2