Loading malware…
StealBit is a Windows information-stealing and data-exfiltration malware family developed and maintained by the LockBit ransomware operation, tracked as GOLD MYSTIC. Introduced alongside LockBit 2.0 in June 2021, it is supplied through the operation’s affiliate panel and deployed within compromised organizational networks to steal files, typically before ransomware encryption. Its role is to support double extortion by obtaining data that affiliates can threaten to publish.
StealBit selectively collects files using configured file-extension lists and supports operator-specified files or folders, including drag-and-drop input through its graphical interface. It uses Windows I/O completion ports and worker threads to parallelize transfers, with named-pipe communication coordinating multiple instances. Stolen file contents are uploaded to embedded attacker-controlled endpoints through HTTP PUT requests, accompanied by metadata identifying the host, domain, file location, and configuration or affiliate. It supports multiple exfiltration destinations for failover and configurable transfer-rate throttling. Analyzed samples transmitted file contents without compression.
Defense-evasion and anti-analysis features include obfuscated strings and endpoint information, RC4-encrypted embedded strings, dynamic API resolution, and debugger detection through the Process Environment Block. Some versions support optional self-deletion by overwriting and removing their executable. Window-hiding functionality is incomplete in some analyzed samples. Older versions enforced geographic execution restrictions covering several former Soviet countries; later samples removed those restrictions. StealBit is an affiliate-operated post-compromise tool, distinct from the LockBit ransomware encryptor.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
StealBit — a tool developed by GOLD MYSTIC to facilitate data exfiltration in LockBit ransomware intrusions
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Recorded Commands cmd.exe /c vssadmin Delete Shadows /All /Quiet ... cmd.exe /c wevtutil cl security
[StealBit](https://attack.mitre.org/software/S1200) can use native APIs including `LoadLibraryExA` for execution and `NtSetInformationProcess` for defense evasion purposes.(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.(Citation: Cybereason StealBit Exfiltration Tool)
StealBit stores the XOR obfuscated filenames of these DLLs in the malware’s executable file ... StealBit then decrypts RC4-encrypted strings that the malware stores in the malware’s executable file.
[StealBit](https://attack.mitre.org/software/S1200) stores obfuscated DLL file names in its executable.(Citation: Cybereason StealBit Exfiltration Tool)
Woody RAT 'has suppressed all error reporting by calling SetErrorMode with 0x8007 as a parameter'; StealBit 'can configure processes to not display certain Windows error messages by through use of the NtSetInformationProcess.'
Many entries explicitly describe deleting artifacts 'to cover tracks,' 'evade detection,' 'remove evidence,' 'reduce their footprint,' or as part of 'post-intrusion cleanup process.' Examples include APT28 deleting files to cover tracks, FIN5 using SDelete to clean up the environment, and Dragonfly deleting operational files as part of cleanup.
[StealBit](https://attack.mitre.org/software/S1200) can self-delete its executable file from the compromised system.(Citation: Cybereason StealBit Exfiltration Tool)(Citation: FBI Lockbit 2.0 FEB 2022)
[StealBit](https://attack.mitre.org/software/S1200) can deobfuscate loaded modules prior to execution.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) will execute an empty infinite loop if it detects it is being run in the context of a debugger.(Citation: Cybereason StealBit Exfiltration Tool)
This parameter controls the visibility of the graphical user interface of StealBit—that is, this parameter hides ( yes/y ) or displays ( no/n ) windows that StealBit creates.
[StealBit](https://attack.mitre.org/software/S1200) can detect it is being run in the context of a debugger.(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) can configure processes to not display certain Windows error messages by through use of the `NtSetInformationProcess`.(Citation: Cybereason StealBit Exfiltration Tool)
Threat actors use this information to search for high-level credentials that can allow them to move freely within an organization’s network
[StealBit](https://attack.mitre.org/software/S1200) can enumerate the computer name and domain membership of the compromised system.(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) can be configured to exfiltrate specific file types.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)
Older samples do not execute on systems located in the former Soviet countries ... StealBit determines the location of a compromised system based on the system’s default language.
[StealBit](https://attack.mitre.org/software/S1200) can determine system location based on the default language setting and will not execute on systems located in former Soviet countries.(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) can detect it is being run in the context of a debugger.(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) can upload data and files to the LockBit victim-shaming site.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)
StealBIT is an information stealer used by the gang for data exfiltration.
[StealBit](https://attack.mitre.org/software/S1200) can use HTTP to exfiltrate files to actor-controlled infrastructure.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)
[StealBit](https://attack.mitre.org/software/S1200) can use the Windows Socket networking library to communicate with attacker-controlled endpoints.(Citation: Cybereason StealBit Exfiltration Tool)
The LockBit group provides StealBit to affiliates as part of the group’s ransomware affiliate program.
On that repository, law enforcement also discovered source code for LockBit’s StealBit tool, which helped LockBit affiliates exfiltrate data stolen through LockBit attacks.
[StealBit](https://attack.mitre.org/software/S1200) can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.(Citation: Cybereason StealBit Exfiltration Tool)
Exmatter is designed to steal a range of user files, databases and compressed files ... and then upload them to a preconfigured server via Secure File Transfer Protocol (SFTP).
When a victim’s network was infected by LockBit’s malicious software, their data was stolen and their systems encrypted.
The alert also noted that the group has used a custom tool, Stealbit, and web services for data exfiltration.
Doelservers of -services bevinden zich onder meer bij Mega, pCloud, Dropbox, Sendspace, OneDrive, GitHub en Google Drive. MegaSync en Rclone worden genoemd als veelgebruikte tooling.
This tool has been observed shortly before ransomware deployment on the victim's network.
“Twisted Spider is the first ransomware gang to steal sensitive data and use it for a second extortion demand. LockBit was one of the early adopters of this tactic…” and “LockBit developed its own data exfiltration tool called ‘StealBit’…”
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.