MalwareUsed by 1 actor

MegaCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

MegaCreep is a previously undocumented backdoor based on DeepCreep, with added functionalities. It reads and executes commands from a text file stored in Mega cloud storage.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

T1129Shared ModulesEvidence1

DeepCreep and MegaCreep have their code divided into small DLLs, which are loaded both statically and dynamically.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Stealth

2 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

POLONIUM has used filenames such as Mega.exe or DropBox.exe for its backdoors, to make them look like legitimate binaries.

T1140Deobfuscate/Decode Files or InformationEvidence1

DeepCreep and MegaDeep use AES encryption to obfuscate commands and login credentials stored in local files on the victim’s computer.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

their malicious activity includes the ability to log keystrokes, take screenshots of the desktop, take photos with the webcam, exfiltrate files from the host, install additional malware, and execute commands on the infected device.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

T1057Process DiscoveryEvidence1

DeepCreep, MegaCreep and FlipCreep look for running processes and kill other instances of themselves.

Collection

4 techniques

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence1

T1125Video CaptureEvidence1

T1560.002Archive via LibraryEvidence1

DeepCreep, MegaCreep and FlipCreep use .NET’s ZipFile class to archive collected data.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

Some backdoors abuse legitimate cloud services, such as OneDrive, Dropbox, and Mega, to act as command and control (C2) servers. Other backdoors utilize standard TCP connections to remote C2 servers or get commands to execute from files hosted on FTP servers.

T1102.002Bidirectional CommunicationEvidence1

POLONIUM has used cloud platforms such as OneDrive, Dropbox, and Mega to send commands and store the output.

T1105Ingress Tool TransferEvidence1

T1573.001Symmetric CryptographyEvidence1

DeepCreep and MegaCreep AES encrypt commands and their output.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

T1567.002Exfiltration to Cloud StorageEvidence1

POLONIUM has used OneDrive, Dropbox, and Mega cloud storage to store stolen information.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Oct 11, 2022

Hacking group POLONIUM uses ‘Creepy’ malware against Israel

A custom POLONIUM backdoor used for cyberespionage. Across these backdoors, capabilities include keylogging, screenshots, webcam capture, file exfiltration, installing additional malware, and remote command execution.

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A C# backdoor derived from DeepCreep that uses Mega cloud storage for C2, supports AES-encrypted commands and output, file transfer, command execution, and persistence.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

MegaCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

MegaCreep is a previously undocumented backdoor based on DeepCreep, with added functionalities. It reads and executes commands from a text file stored in Mega cloud storage.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

T1129Shared ModulesEvidence1

DeepCreep and MegaCreep have their code divided into small DLLs, which are loaded both statically and dynamically.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1547.009Shortcut ModificationEvidence1

DeepCreep persists by creating a LNK file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Stealth

2 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

POLONIUM has used filenames such as Mega.exe or DropBox.exe for its backdoors, to make them look like legitimate binaries.

T1140Deobfuscate/Decode Files or InformationEvidence1

DeepCreep and MegaDeep use AES encryption to obfuscate commands and login credentials stored in local files on the victim’s computer.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

T1057Process DiscoveryEvidence1

DeepCreep, MegaCreep and FlipCreep look for running processes and kill other instances of themselves.

Collection

4 techniques

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence1

T1125Video CaptureEvidence1

T1560.002Archive via LibraryEvidence1

DeepCreep, MegaCreep and FlipCreep use .NET’s ZipFile class to archive collected data.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

T1102.002Bidirectional CommunicationEvidence1

POLONIUM has used cloud platforms such as OneDrive, Dropbox, and Mega to send commands and store the output.

T1105Ingress Tool TransferEvidence1

T1573.001Symmetric CryptographyEvidence1

DeepCreep and MegaCreep AES encrypt commands and their output.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

T1567.002Exfiltration to Cloud StorageEvidence1

POLONIUM has used OneDrive, Dropbox, and Mega cloud storage to store stolen information.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Oct 11, 2022

Hacking group POLONIUM uses ‘Creepy’ malware against Israel

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A C# backdoor derived from DeepCreep that uses Mega cloud storage for C2, supports AES-encrypted commands and output, file transfer, command execution, and persistence.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.