StealBit
- ID
- S1200
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 30 Jan 2025
StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.[1][2]
Techniques used (15)
- T1005 Data from Local System
- T1027.013 Encrypted/Encoded File
- T1030 Data Transfer Size Limits
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1095 Non-Application Layer Protocol
- T1106 Native API
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1559 Inter-Process Communication
- T1614.001 System Language Discovery
- T1622 Debugger Evasion
- T1685 Disable or Modify Tools