ATT&CK ReferencesProofpoint LookBack Malware Aug 2019

Proofpoint LookBack Malware Aug 2019

Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software1

LookBack

Campaigns0

None recorded.

Procedure examples16

Technique	Used by	Procedure example
T1007 System Service Discovery	MalwareLookBack	LookBack can enumerate services on the victim machine. Proofpoint LookBack Malware Aug 2019
T1036.005 Match Legitimate Resource Name or Location	MalwareLookBack	LookBack has a C2 proxy tool that masquerades as `GUP.exe`, which is software used by Notepad++. Proofpoint LookBack Malware Aug 2019
T1057 Process Discovery	MalwareLookBack	LookBack can list running processes. Proofpoint LookBack Malware Aug 2019
T1059.003 Windows Command Shell	MalwareLookBack	LookBack executes the `cmd.exe` command. Proofpoint LookBack Malware Aug 2019
T1059.005 Visual Basic	MalwareLookBack	LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host. Proofpoint LookBack Malware Aug 2019
T1070.004 File Deletion	MalwareLookBack	LookBack removes itself after execution and can delete files on the system. Proofpoint LookBack Malware Aug 2019
T1071.001 Web Protocols	MalwareLookBack	LookBack’s C2 proxy tool sends data to a C2 server over HTTP. Proofpoint LookBack Malware Aug 2019
T1083 File and Directory Discovery	MalwareLookBack	LookBack can retrieve file listings from the victim machine. Proofpoint LookBack Malware Aug 2019
T1095 Non-Application Layer Protocol	MalwareLookBack	LookBack uses a custom binary protocol over sockets for C2 communications. Proofpoint LookBack Malware Aug 2019
T1113 Screen Capture	MalwareLookBack	LookBack can take desktop screenshots. Proofpoint LookBack Malware Aug 2019
T1140 Deobfuscate/Decode Files or Information	MalwareLookBack	LookBack has a function that decrypts malicious data. Proofpoint LookBack Malware Aug 2019
T1489 Service Stop	MalwareLookBack	LookBack can kill processes and delete services. Proofpoint LookBack Malware Aug 2019
T1529 System Shutdown/Reboot	MalwareLookBack	LookBack can shutdown and reboot the victim machine. Proofpoint LookBack Malware Aug 2019
T1547.001 Registry Run Keys / Startup Folder	MalwareLookBack	LookBack sets up a Registry Run key to establish a persistence mechanism. Proofpoint LookBack Malware Aug 2019
T1573.001 Symmetric Cryptography	MalwareLookBack	LookBack uses a modified version of RC4 for data transfer. Proofpoint LookBack Malware Aug 2019
T1574.001 DLL	MalwareLookBack	LookBack side loads its communications module as a DLL into the `libcurl.dll` loader. Proofpoint LookBack Malware Aug 2019

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.