MalwareUsed by 1 actor

LightBot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Overdose

The same actor also uses LightBot, which is a set of PowerShell scripts designed to perform reconnaissance on victim networks, hardware, and software, in order to hand-pick which are high-value targets.

via eclypsium blogeclypsium.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Over the past week, security researchers began to see a phishing campaign normally used to distribute TrickBot's BazarLoader malware switch to installing a new malicious PowerShell script.

T1566.002Spearphishing LinkEvidence1

LightBot phishing emails pretend to be from human resources or the legal department about a customer complaint or the termination of the recipient's employment... they contain links to a document on https://drive.google.com.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

This PowerShell script is launched every day at 7 AM through a created scheduled task... It is believed to be a persistence method.

T1059.001PowerShellEvidence2

The downloaded file is a JavaScript file that will launch the LightBot PowerShell script.

T1059.007JavaScriptEvidence1

The downloaded file is a JavaScript file that will launch the LightBot PowerShell script.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

This PowerShell script is launched every day at 7 AM through a created scheduled task... It is believed to be a persistence method.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

This PowerShell script is launched every day at 7 AM through a created scheduled task... It is believed to be a persistence method.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

you can see the script used to collect information about the computer's IP address configuration and Windows domain... Configured IP address DNS domain Type of network card

T1082System Information DiscoveryEvidence1

LightBot is a lightweight reconnaissance tool that gathers information about a victim's network... From our runs of the malicious script, LightBot collects the following data: Computer name Hardware info User name Windows version ... List of installed programs

T1482Domain Trust DiscoveryEvidence1

LightBot is focused on reconnaissance for high-value targets via network and active directory... you can see the script used to collect information about the computer's IP address configuration and Windows domain.

Command and Control

2 techniques

T1001Data ObfuscationEvidence1

The first is a text file containing an encrypted base64 encoded string and the second file is a PowerShell script that decodes the base64 string and executes it.

T1071Application Layer ProtocolEvidence1

When the LightBot PowerShell script is executed, it will make repeated connections to a command and control (C2) server to receive additional PowerShell scripts to execute and to send data collected during previous runs.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

eclypsium blogNews

Dec 3, 2020

TrickBot Now Offers "TrickBoot": Persist, Brick, Profit

A PowerShell-based reconnaissance toolkit used by the same actors to survey victim environments and identify high-value targets.

bleeping computerNews

Nov 20, 2020

LightBot: TrickBot’s new reconnaissance malware for high-value targets

A lightweight PowerShell-based reconnaissance tool used by the TrickBot group to profile infected networks, enumerate domain and host details, communicate with C2 for follow-on scripts, and likely establish persistence via a scheduled task.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

LightBot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Overdose

via eclypsium blogeclypsium.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Over the past week, security researchers began to see a phishing campaign normally used to distribute TrickBot's BazarLoader malware switch to installing a new malicious PowerShell script.

T1566.002Spearphishing LinkEvidence1

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

This PowerShell script is launched every day at 7 AM through a created scheduled task... It is believed to be a persistence method.

T1059.001PowerShellEvidence2

The downloaded file is a JavaScript file that will launch the LightBot PowerShell script.

T1059.007JavaScriptEvidence1

The downloaded file is a JavaScript file that will launch the LightBot PowerShell script.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

This PowerShell script is launched every day at 7 AM through a created scheduled task... It is believed to be a persistence method.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

This PowerShell script is launched every day at 7 AM through a created scheduled task... It is believed to be a persistence method.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

you can see the script used to collect information about the computer's IP address configuration and Windows domain... Configured IP address DNS domain Type of network card

T1082System Information DiscoveryEvidence1

T1482Domain Trust DiscoveryEvidence1

Command and Control

2 techniques

T1001Data ObfuscationEvidence1

The first is a text file containing an encrypted base64 encoded string and the second file is a PowerShell script that decodes the base64 string and executes it.

T1071Application Layer ProtocolEvidence1

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

eclypsium blogNews

Dec 3, 2020

TrickBot Now Offers "TrickBoot": Persist, Brick, Profit

A PowerShell-based reconnaissance toolkit used by the same actors to survey victim environments and identify high-value targets.

bleeping computerNews

Nov 20, 2020

LightBot: TrickBot’s new reconnaissance malware for high-value targets

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.