Loading malware…
StealBit is a custom Windows data-exfiltration malware developed and maintained by the LockBit ransomware operation for use by its affiliates in double-extortion intrusions. It is distributed through the LockBit affiliate panel and is used before or alongside ransomware deployment to steal selected victim data for extortion leverage. LockBit operators initially relied on public tools for theft, but later industrialized this stage with StealBit as a bespoke exfiltration utility.
StealBit is closely associated with LockBit and has been described as a bespoke stealer or information-stealing tool, but its primary demonstrated role is selective file theft and bulk exfiltration from compromised environments. It supports parallelized transfer using Windows I/O completion ports, uses named-pipe-based interprocess communication between instances, and can transmit stolen file contents over HTTP PUT requests. Reported samples include anti-analysis and obfuscation features such as debugger checks via NtGlobalFlag inspection, encrypted or obfuscated strings and endpoint data, and partial execution-hiding behavior. Some versions also support self-deletion by overwriting and removing their executable after use, and newer variants added throttling controls for transfer speed. Older samples reportedly avoided execution in several former Soviet states, while newer samples removed that restriction.
Operationally, StealBit is used by LockBit affiliates after network compromise and prior to encryption to exfiltrate targeted file types from victim systems. It has been observed as part of broader LockBit intrusions that also involve privilege escalation, reconnaissance, lateral movement, and eventual ransomware deployment. Public reporting and law-enforcement actions have tied StealBit source code and operational use directly to the LockBit ecosystem, including the 2024 disruption of LockBit infrastructure. The malware is part of the broader maturation of ransomware-as-a-service operations, where custom exfiltration tooling improves speed, consistency, and extortion effectiveness across affiliate-led attacks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this Threat Analysis report, the GSOC investigates the StealBit malware, a data exfiltration tool that the LockBit threat group develops and maintains.
StealBit — a tool developed by GOLD MYSTIC to facilitate data exfiltration in LockBit ransomware intrusions
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Recorded Commands cmd.exe /c vssadmin Delete Shadows /All /Quiet ... cmd.exe /c wevtutil cl security
MITRE ATT&CK Techniques for StealBit Malware ... Native API ... StealBit first checks whether the StealBit process runs in the context of a debugger ... StealBit creates the named pipe file ... by invoking the NtCreateNamedPipeFile function ... invokes the ZwReadFile function to read the content of the file
StealBit stores the XOR obfuscated filenames of these DLLs in the malware’s executable file ... StealBit then decrypts RC4-encrypted strings that the malware stores in the malware’s executable file.
Woody RAT 'has suppressed all error reporting by calling SetErrorMode with 0x8007 as a parameter'; StealBit 'can configure processes to not display certain Windows error messages by through use of the NtSetInformationProcess.'
Many entries explicitly describe deleting artifacts 'to cover tracks,' 'evade detection,' 'remove evidence,' 'reduce their footprint,' or as part of 'post-intrusion cleanup process.' Examples include APT28 deleting files to cover tracks, FIN5 using SDelete to clean up the environment, and Dragonfly deleting operational files as part of cleanup.
As infection begins, Lockbit 2.0 deletes log files and shadow copies residing on disk.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
StealBit displays the computer name of the compromised system and the name of the domain to which the system belongs ... The data that StealBit sends to the attacker-controlled endpoint includes ... The computer name of the compromised system and the name of the domain
In StealBIT this is implemented by having a hardcoded list of extensions that should be extracted.
On that repository, law enforcement also discovered source code for LockBit’s StealBit tool, which helped LockBit affiliates exfiltrate data stolen through LockBit attacks.
To evade exfiltration detection mechanisms that monitor the amount of sent data to remote endpoints over time, StealBit operators can configure StealBit to exfiltrate file content at a given rate ... by configuring the -net/-n or -once/-o command line parameters.
Exmatter is designed to steal a range of user files, databases and compressed files ... and then upload them to a preconfigured server via Secure File Transfer Protocol (SFTP).
The content repeatedly describes threat actors and malware disabling or modifying security tools, EDR/AV, logging, firewall rules, integrity checkers, and security settings; e.g., 'Agrius used several mechanisms to try to disable security tools' and 'BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.'
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A LockBit-associated data theft utility introduced alongside LockBit 2.0 to exfiltrate files as part of double-extortion operations.
Stealbit is a tool used by the LockBit group to exfiltrate data from victim networks prior to or during ransomware attacks, facilitating double extortion tactics.
LockBit 운영에서 데이터 유출(탈취)을 수행하기 위해 사용되는 전용 도구로 언급된다.
A custom data exfiltration tool developed by GOLD MYSTIC for use in LockBit intrusions, used to steal victim data prior to extortion and possible publication on LockBit infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.