{
	"id": "053de1be-7b18-45bf-907d-6e9602d7eec3",
	"created_at": "2026-04-06T03:36:30.206011Z",
	"updated_at": "2026-04-10T03:31:13.509296Z",
	"deleted_at": null,
	"sha1_hash": "305271ffaaf8d59bb9403ec5f3b6cbcaf33059ba",
	"title": "LOLBAS",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 30737,
	"plain_text": "LOLBAS\r\nArchived: 2026-04-06 03:34:46 UTC\r\nLiving Off The Land Binaries, Scripts and Libraries\r\nFor more info on the project, click on the logo.\r\nIf you want to contribute, check out our contribution guide. Our criteria list sets out what we define as a\r\nLOLBin/Script/Lib. More information on programmatically accesssing this project can be found on the API page.\r\nMITRE ATT\u0026CK® and ATT\u0026CK® are registered trademarks of The MITRE Corporation. You can see the\r\ncurrent ATT\u0026CK® mapping of this project on the ATT\u0026CK® Navigator.\r\nIf you are looking for UNIX binaries, please visit gtfobins.github.io.\r\nIf you are looking for drivers, please visit loldrivers.io.\r\nSource: https://lolbas-project.github.io/#t1105\r\nhttps://lolbas-project.github.io/#t1105\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://lolbas-project.github.io/#t1105"
	],
	"report_names": [
		"#t1105"
	],
	"threat_actors": [
		{
			"id": "f4f16213-7a22-4527-aecb-b964c64c2c46",
			"created_at": "2024-06-19T02:03:08.090932Z",
			"updated_at": "2026-04-10T02:00:03.6289Z",
			"deleted_at": null,
			"main_name": "GOLD NIAGARA",
			"aliases": [
				"Calcium ",
				"Carbanak",
				"Carbon Spider ",
				"FIN7 ",
				"Navigator ",
				"Sangria Tempest ",
				"TelePort Crew "
			],
			"source_name": "Secureworks:GOLD NIAGARA",
			"tools": [
				"Bateleur",
				"Carbanak",
				"Cobalt Strike",
				"DICELOADER",
				"DRIFTPIN",
				"GGLDR",
				"GRIFFON",
				"JSSLoader",
				"Meterpreter",
				"OFFTRACK",
				"PILLOWMINT",
				"POWERTRASH",
				"SUPERSOFT",
				"TAKEOUT",
				"TinyMet"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775446590,
	"ts_updated_at": 1775791873,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/305271ffaaf8d59bb9403ec5f3b6cbcaf33059ba.pdf",
		"text": "https://archive.orkl.eu/305271ffaaf8d59bb9403ec5f3b6cbcaf33059ba.txt",
		"img": "https://archive.orkl.eu/305271ffaaf8d59bb9403ec5f3b6cbcaf33059ba.jpg"
	}
}