H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

LP-Notes

[LP-Notes](https://attack.mitre.org/software/S9036) is a C/C++ Windows credential stealer used by [MuddyWater](https://attack.mitre.org/groups/G0069). [LP-Notes](https://attack.mitre.org/software/S9036) was named after the `lp-notes.txt` file that is used to store stolen credentials.(Citation: ESET_MuddyWater_Dec2025)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[LP-Notes](https://attack.mitre.org/software/S9036) is a C/C++ Windows credential stealer used by [MuddyWater](https://attack.mitre.org/groups/G0069). [LP-Notes](https://attack.mitre.org/software/S9036) was named after the `lp-notes.txt` file that is used to store stolen credentials.(Citation: ESET_MuddyWater_Dec2025)

Labels

malware
12 recorded

Relationships

uses
to Archive Collected Data
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Dynamic API Resolution
Technique
uses
to Encrypted/Encoded File
Technique
uses
to GUI Input Capture
Technique
uses
to Local Data Staging
Technique
uses
to Native API
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Token Impersonation/Theft
Technique
uses
to Valid Accounts
Technique
uses
from MuddyWater
Group
2 external

References

mitre-attack
S9036
open
ESET_MuddyWater_Dec2025
https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance