Cybereason StealBit Exfiltration Tool

StealBit can upload data and files to the LockBit victim-shaming site.

StealBit stores obfuscated DLL file names in its executable.

StealBit can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.

StealBit can self-delete its executable file from the compromised system.

StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure.

StealBit can enumerate the computer name and domain membership of the compromised system.

StealBit can be configured to exfiltrate specific file types.

StealBit can use the Windows Socket networking library to communicate with attacker-controlled endpoints.

StealBit can use native APIs including `LoadLibraryExA` for execution and `NtSetInformationProcess` for defense evasion purposes.

StealBit can deobfuscate loaded modules prior to execution.

StealBit will execute an empty infinite loop if it detects it is being run in the context of a debugger.

StealBit can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.

StealBit can determine system location based on the default language setting and will not execute on systems located in former Soviet countries.

StealBit can detect it is being run in the context of a debugger.

StealBit can configure processes to not display certain Windows error messages by through use of the `NtSetInformationProcess`.