defection.io

malware

StealBit S1200

Type: malware
Platform: Windows
Created: 29 January 2025
Last modified: 29 January 2025

StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.[1][2]

Techniques66th pct

Tactics68th pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

StealBit S1200

Type: malware
Platform: Windows
Created: 29 January 2025
Last modified: 29 January 2025

Techniques66th pct

Tactics68th pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

StealBit MITRE reference S1200

Data from Local System T1005 ↗

StealBit can upload data and files to the LockBit victim-shaming site.3 4

Collection22 detection rules

Encrypted/Encoded File T1027.013 ↗

StealBit stores obfuscated DLL file names in its executable.5

Stealth1 detection rules

Data Transfer Size Limits T1030 ↗

StealBit can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.6

Exfiltration5 detection rules

File Deletion T1070.004 ↗

StealBit can self-delete its executable file from the compromised system.7 8

Stealth30 detection rules

Web Protocols T1071.001 ↗

StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure.9 10

Command and Control60 detection rules

System Information Discovery T1082 ↗

StealBit can enumerate the computer name and domain membership of the compromised system.11

Discovery54 detection rules

Standing S1200

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1566th pct

66th percentile · 66% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics768th pct

68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique14med29th pct

29th percentile · 71% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique5med42nd pct

42nd percentile · 58% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 15 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 333Splunk ESCU (cumulative) · 198