Malware

Daolpu

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The initial payload is a DOCM file, spread through a phishing campaign.

Stealth

2 techniques

T1218.011Rundll32Evidence1

START " " rundll32 C:\Users\admin\AppData\Local\Temp\mscorsvc.dll, DllMain

T1497.001System ChecksEvidence1

To uniquely identify the victim, the malware uses the MAC address as part of the host fingerprint.

Credential Access

1 technique

T1555Credentials from Password StoresEvidence1

The malware extracts passwords and sensitive data from the previously cited browsers.

Discovery

1 technique

T1497.001System ChecksEvidence1

To uniquely identify the victim, the malware uses the MAC address as part of the host fingerprint.

Collection

2 techniques

T1005Data from Local SystemEvidence1

The malware also crawls the disk seeking sensitive documents, exfiltrating every file that matches the following extensions: .doc, .docx, .xls, .xlsx, .pdf, .txt, .ppt, and .pptx.

T1119Automated CollectionEvidence1

The malware automatically exfiltrates credentials from the following browsers: Mozilla Firefox, Microsoft Edge, Google Chrome, and Coc Coc Browser.

Command and Control

3 techniques

T1102Web ServiceEvidence1

The next picture details the MITRE ATT&CK techniques utilized by the malware sample and each of its components (... Web Service ... Exfiltration Over Web Service ...)

T1105Ingress Tool TransferEvidence1

Once opened, the weaponized document downloads and executes a stealer.

T1571Non-Standard PortEvidence1

IOCs URLs http://172 [dot] 104.160.126:8099/payload2.txt http://172 [dot] 104.160.126:5000/Uploadss

Exfiltration

2 techniques

T1020Automated ExfiltrationEvidence1

The exfiltration is performed automatically over an HTTP channel using multipart POST uploads.

T1567Exfiltration Over Web ServiceEvidence1

The exfiltration is performed automatically over an HTTP channel using multipart POST uploads.

Impact

1 technique

T1657Financial TheftEvidence1

Because the malware is a stealer, its sole goal is to collect and exfiltrate data... such as identity theft or financial fraud.

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ip.v4●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

uri●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

tehtris blogNews

Nov 18, 2024

Cryptbot downloader: A deep cryptanalysis - TEHTRIS

Mentioned only as a comparison for use of unencrypted HTTP transport by malware families.

tehtris blogNews

Jul 25, 2024

Daolpu Infostealer: Full analysis of the latest malware exploited post CrowdStrike outage - TEHTRIS

A credential- and document-stealing malware delivered via a weaponized Word macro document themed around the CrowdStrike outage. It downloads a DLL payload, fingerprints victims via MAC address, steals browser credentials from Firefox, Edge, Chrome, and Coc Coc Browser, collects common document types, and exfiltrates the data over HTTP multipart POST requests.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Daolpu

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The initial payload is a DOCM file, spread through a phishing campaign.

Stealth

2 techniques

T1218.011Rundll32Evidence1

START " " rundll32 C:\Users\admin\AppData\Local\Temp\mscorsvc.dll, DllMain

T1497.001System ChecksEvidence1

To uniquely identify the victim, the malware uses the MAC address as part of the host fingerprint.

Credential Access

1 technique

T1555Credentials from Password StoresEvidence1

The malware extracts passwords and sensitive data from the previously cited browsers.

Discovery

1 technique

T1497.001System ChecksEvidence1

To uniquely identify the victim, the malware uses the MAC address as part of the host fingerprint.

Collection

2 techniques

T1005Data from Local SystemEvidence1

The malware also crawls the disk seeking sensitive documents, exfiltrating every file that matches the following extensions: .doc, .docx, .xls, .xlsx, .pdf, .txt, .ppt, and .pptx.

T1119Automated CollectionEvidence1

The malware automatically exfiltrates credentials from the following browsers: Mozilla Firefox, Microsoft Edge, Google Chrome, and Coc Coc Browser.

Command and Control

3 techniques

T1102Web ServiceEvidence1

The next picture details the MITRE ATT&CK techniques utilized by the malware sample and each of its components (... Web Service ... Exfiltration Over Web Service ...)

T1105Ingress Tool TransferEvidence1

Once opened, the weaponized document downloads and executes a stealer.

T1571Non-Standard PortEvidence1

IOCs URLs http://172 [dot] 104.160.126:8099/payload2.txt http://172 [dot] 104.160.126:5000/Uploadss

Exfiltration

2 techniques

T1020Automated ExfiltrationEvidence1

The exfiltration is performed automatically over an HTTP channel using multipart POST uploads.

T1567Exfiltration Over Web ServiceEvidence1

The exfiltration is performed automatically over an HTTP channel using multipart POST uploads.

Impact

1 technique

T1657Financial TheftEvidence1

Because the malware is a stealer, its sole goal is to collect and exfiltrate data... such as identity theft or financial fraud.

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ip.v4●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

uri●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

tehtris blogNews

Nov 18, 2024

Cryptbot downloader: A deep cryptanalysis - TEHTRIS

Mentioned only as a comparison for use of unencrypted HTTP transport by malware families.

tehtris blogNews

Jul 25, 2024

Daolpu Infostealer: Full analysis of the latest malware exploited post CrowdStrike outage - TEHTRIS

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.