LP-Notes
- ID
- S9036
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 23 Apr 2026
LP-Notes is a C/C++ Windows credential stealer used by MuddyWater. LP-Notes was named after the lp-notes.txt file that is used to store stolen credentials.[1]
Techniques used (11)
- T1027.007 Dynamic API Resolution
- T1027.013 Encrypted/Encoded File
- T1056.002 GUI Input Capture
- T1057 Process Discovery
- T1059.001 PowerShell
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1106 Native API
- T1134.001 Token Impersonation/Theft
- T1140 Deobfuscate/Decode Files or Information
- T1560 Archive Collected Data