ATT&CK SoftwareLookBack

LookBack

S0582

Malware.View on attack.mitre.org

About this malware

LookBack is a remote access trojan written in C++ that was used against at least three US utility companies in July 2019. The TALONITE activity group has been observed using LookBack.

Procedure examples16

Technique	Procedure example
T1007 System Service Discovery	LookBack can enumerate services on the victim machine. Proofpoint LookBack Malware Aug 2019
T1036.005 Match Legitimate Resource Name or Location	LookBack has a C2 proxy tool that masquerades as `GUP.exe`, which is software used by Notepad++. Proofpoint LookBack Malware Aug 2019
T1057 Process Discovery	LookBack can list running processes. Proofpoint LookBack Malware Aug 2019
T1059.003 Windows Command Shell	LookBack executes the `cmd.exe` command. Proofpoint LookBack Malware Aug 2019
T1059.005 Visual Basic	LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host. Proofpoint LookBack Malware Aug 2019
T1070.004 File Deletion	LookBack removes itself after execution and can delete files on the system. Proofpoint LookBack Malware Aug 2019
T1071.001 Web Protocols	LookBack’s C2 proxy tool sends data to a C2 server over HTTP. Proofpoint LookBack Malware Aug 2019
T1083 File and Directory Discovery	LookBack can retrieve file listings from the victim machine. Proofpoint LookBack Malware Aug 2019
T1095 Non-Application Layer Protocol	LookBack uses a custom binary protocol over sockets for C2 communications. Proofpoint LookBack Malware Aug 2019
T1113 Screen Capture	LookBack can take desktop screenshots. Proofpoint LookBack Malware Aug 2019
T1140 Deobfuscate/Decode Files or Information	LookBack has a function that decrypts malicious data. Proofpoint LookBack Malware Aug 2019
T1489 Service Stop	LookBack can kill processes and delete services. Proofpoint LookBack Malware Aug 2019
T1529 System Shutdown/Reboot	LookBack can shutdown and reboot the victim machine. Proofpoint LookBack Malware Aug 2019
T1547.001 Registry Run Keys / Startup Folder	LookBack sets up a Registry Run key to establish a persistence mechanism. Proofpoint LookBack Malware Aug 2019
T1573.001 Symmetric Cryptography	LookBack uses a modified version of RC4 for data transfer. Proofpoint LookBack Malware Aug 2019

View all 16 procedure examples

Groups that use it0

None recorded.

Campaigns0

None recorded.

References3

Dragos TALONITE Open source
Dragos. (null). TALONITE. Retrieved February 25, 2021.
Dragos Threat Report 2020 Open source
Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.
Proofpoint LookBack Malware Aug 2019 Open source
Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.