S0582 LookBack

malwareEnterprise

platformsWindows

also known asLookBack

LookBack is a remote access trojan written in C++ that was used against at least three US utility companies in July 2019. The TALONITE activity group has been observed using LookBack.

techniques used (16)

ATT&CK techniques this enables or maps to.

T1007System Service Discovery
T1036.005Match Legitimate Resource Name or Location
T1057Process Discovery
T1059.003Windows Command Shell
T1059.005Visual Basic
T1070.004File Deletion
T1071.001Web Protocols
T1083File and Directory Discovery
T1095Non-Application Layer Protocol
T1113Screen Capture
T1140Deobfuscate/Decode Files or Information
T1489Service Stop
T1529System Shutdown/Reboot
T1547.001Registry Run Keys / Startup Folder
T1573.001Symmetric Cryptography
T1574.001DLL

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan