Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
21 views4 pages

Lokbit

The document outlines a network alert for potential data exfiltration by the Stealbit malware, detailing specific HTTP POST requests and associated indicators of compromise (IOCs). It lists various SHA2 hashes, IP addresses, and a link to a LockBit onion site, along with MITRE ATT&CK techniques related to the malware's operation. The alert emphasizes the need for monitoring and defense against such threats in network environments.

Uploaded by

Sanoop S Nair
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
21 views4 pages

Lokbit

The document outlines a network alert for potential data exfiltration by the Stealbit malware, detailing specific HTTP POST requests and associated indicators of compromise (IOCs). It lists various SHA2 hashes, IP addresses, and a link to a LockBit onion site, along with MITRE ATT&CK techniques related to the malware's operation. The alert emphasizes the need for monitoring and defense against such threats in network environments.

Uploaded by

Sanoop S Nair
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 4

alert tcp any any -> any $HTTP_PORTS (msg:"Stealbit Data Exfil";

flow:to_server,established; content:"POST"; http_method; content:"&filesize=";


content:"&framesize="; content:"&framenum="; content:"&filecrc=";
content:"&filename="; content:"&pcname="; classtype:trojan-activity; sid:20166338;
rev:3; metadata:created_at 2021_08_12;)

INDICATORS OF COMPROMISE

Descrip
IOC Type
tion
16a707a3965ebd71ebc831b68863b855b2c8d60aef8efdef1e0 SHA2 LockBit2.
c0a6cc28e9bc7 56 0
e32dc551a721b43da44a068f38928d3e363435ce0e4d2e0479
c0dfdb27563c82
0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8d
bddf99867182d
92ec3373b528e0040fae1c34b6edc8d623d03eac84267bd3ed
408fe547b9c944
9dd6cc25b2f920b825e15682a4d06435a42b281674ba6e99c8
e2b2222c9d638f
56fd91787c641c2329a86813497d0e6ff219c81a4d61ac10fed
ef9cd68c3baed
b583058e06ecee9905c3fb73b44feb6ef0ce66dead14620b8a7
682067df2c8bc
4edbf2358a9820e030136dc76126c20cc38159df0d8d7b13d3
0b1c9351e8b277
6d26226f99724c18faf355a4e07b74bad72f5837e0de8c8361f7
d9a18525b5ae
98900768d564c6962981edde2759889fdda11bb1113c851468
e5c40ddafe1d4d
36446a57a54aba2517efca37eedd77c89dfc06e056369eac323
97e8679660ff7
34e6f4317e223d712a9464cd2e6ba9e6d7915eac75a8c06648
813ea1d7a80b80
a7591e4a248c04547579f014c94d7d30aa16a01bb2a25b77df
36e30a198df108
4bb152c96ba9e25f293bbc03c607918a4452231087053a8cb1
a8accb1acc92fd
f2d0e13a6ec546f169d45ad5b62ced1bcc3a4e01ae6dc366623
9defc959e2baa
717585e9605ac2a971b7c7537e6e311bab9db02ecc6451e0ef
ada9b2ff38b474
bcbb1e388759eea5c1fbb4f35c29b6f66f3f4ca4c715bab35c8fc
56dcf3fa621
0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096
e5c1828e1c049
acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24
f5921b0128b2c
5c268313821c3e851f500e5dea135cce0670f1f2efe4466394d SHA2 StealBit
7dcdaeb321aa8 56
7c7317c7f036c00d4c55d00ba36cb2a58a39a72fe24a4b8d11f
42f81b062f80b
8ea24457df1459297503237411594b734794ee0d2654b22c66
d3a976e2e6ff4f
0d7358a3c04d860883da564d51c983e262d5b3057da29a380
4d5e8f67644e02e
8cfd554a936bd156c4ea29dfd54640d8f870b1ae7738c95ee25
8408eef0ab9e6
a7cf0f72bb6f1e0a61fbf39e3a3a36db6540250caeef35b47fb51
a8959f40984
dcc4ac1302ac5693875c4a4b193242cbb441b77cd918569c43f
e318bcf64fe3d
51.161.82[.]135 IP StealBit
167.172.170[.]139
51.81.153[.]212
51.77.110[.]6

http:// LockBit
lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4yky onion
d[.]onion website
MITRE ATT&CK TECHNIQUES

Initial Lateral Persisten Defense Discovery Command Impact


Access Moveme ce Evasion and Control
nt
Phishing Taint Scheduled Deobfuscate Account Commonly Data Encrypted
Shared Task/Job / Decode Discovery Used Port for Impact
Content Files or
Information

Valid Lateral Boot or Masqueradin Application Remote File System


Account Tool Logon g Window Copy Shutdown/Reboo
s Transfer Autostart Discovery t
Execution
Domain File and Standard
Policy Directory Application
Modification Discovery Layer
Protocol
Process Standard
Discovery Cryptographi
c Protocol
System Standard
Informatio Non-
n Application
Discovery Layer
Protocol

You might also like