MalwareUsed by 1 actor

DeepCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

DeepCreep is a previously undocumented backdoor written in C# that reads commands from a text file stored in Dropbox accounts and can upload or download files to and from those accounts.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

T1129Shared ModulesEvidence1

DeepCreep and MegaCreep have their code divided into small DLLs, which are loaded both statically and dynamically.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

POLONIUM has used filenames such as Mega.exe or DropBox.exe for its backdoors, to make them look like legitimate binaries.

T1140Deobfuscate/Decode Files or InformationEvidence1

DeepCreep and MegaDeep use AES encryption to obfuscate commands and login credentials stored in local files on the victim’s computer.

T1218.004InstallUtilEvidence1

We saw some cases where a separate loader – WindowsTool.exe – was used to implement persistence and execute DeepCreep with InstallUtil, a legitimate tool from the .NET Framework.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

T1057Process DiscoveryEvidence1

DeepCreep, MegaCreep and FlipCreep look for running processes and kill other instances of themselves.

Collection

1 technique

T1560.002Archive via LibraryEvidence1

DeepCreep, MegaCreep and FlipCreep use .NET’s ZipFile class to archive collected data.

Command and Control

2 techniques

T1102.002Bidirectional CommunicationEvidence1

POLONIUM has used cloud platforms such as OneDrive, Dropbox, and Mega to send commands and store the output.

T1573.001Symmetric CryptographyEvidence1

DeepCreep and MegaCreep AES encrypt commands and their output.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

T1567.002Exfiltration to Cloud StorageEvidence1

POLONIUM has used OneDrive, Dropbox, and Mega cloud storage to store stolen information.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A C# backdoor using Dropbox for command retrieval and file transfer. It supports command execution via cmd.exe, file upload/download, ZIP archiving, and persistence via Startup LNK and scheduled tasks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

DeepCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

DeepCreep is a previously undocumented backdoor written in C# that reads commands from a text file stored in Dropbox accounts and can upload or download files to and from those accounts.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

T1129Shared ModulesEvidence1

DeepCreep and MegaCreep have their code divided into small DLLs, which are loaded both statically and dynamically.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

POLONIUM has used filenames such as Mega.exe or DropBox.exe for its backdoors, to make them look like legitimate binaries.

T1140Deobfuscate/Decode Files or InformationEvidence1

DeepCreep and MegaDeep use AES encryption to obfuscate commands and login credentials stored in local files on the victim’s computer.

T1218.004InstallUtilEvidence1

We saw some cases where a separate loader – WindowsTool.exe – was used to implement persistence and execute DeepCreep with InstallUtil, a legitimate tool from the .NET Framework.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

T1057Process DiscoveryEvidence1

DeepCreep, MegaCreep and FlipCreep look for running processes and kill other instances of themselves.

Collection

1 technique

T1560.002Archive via LibraryEvidence1

DeepCreep, MegaCreep and FlipCreep use .NET’s ZipFile class to archive collected data.

Command and Control

2 techniques

T1102.002Bidirectional CommunicationEvidence1

POLONIUM has used cloud platforms such as OneDrive, Dropbox, and Mega to send commands and store the output.

T1573.001Symmetric CryptographyEvidence1

DeepCreep and MegaCreep AES encrypt commands and their output.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

T1567.002Exfiltration to Cloud StorageEvidence1

POLONIUM has used OneDrive, Dropbox, and Mega cloud storage to store stolen information.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.