Home > List all groups > List all tools > List all groups using tool Hekatomb

Threat Group Cards: A Threat Actor Encyclopedia

Names	Hekatomb
Category	Tools
Type	Credential stealer
Description	Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers. Finally, it will extract domain controller private key through RPC uses it to decrypt all credentials.
Information	<https://github.com/Processus-Thief/HEKATOMB>

Last change to this tool card: 29 November 2023

Download this tool card in JSON format

Previous: HeavyLift
Next: Helauto

1 group listed (1 APT, 0 other, 0 unknown)

APT groups