MalwareUsed by 1 actor

PapaCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

PapaCreep is a previously undocumented custom backdoor written in C++ that can receive and execute commands from a remote server via TCP sockets.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.003Virtual Private ServerEvidence1

POLONIUM has acquired various servers for C&C and also for storing exfiltrated files.

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

The advantage is that the components can run independently, persist via separate scheduled tasks in the breached system, and make the backdoor harder to detect.

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

T1129Shared ModulesEvidence1

DeepCreep and MegaCreep have their code divided into small DLLs, which are loaded both statically and dynamically.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

The advantage is that the components can run independently, persist via separate scheduled tasks in the breached system, and make the backdoor harder to detect.

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

The advantage is that the components can run independently, persist via separate scheduled tasks in the breached system, and make the backdoor harder to detect.

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

their malicious activity includes the ability to log keystrokes, take screenshots of the desktop, take photos with the webcam, exfiltrate files from the host, install additional malware, and execute commands on the infected device.

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence1

T1125Video CaptureEvidence1

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

Some backdoors abuse legitimate cloud services, such as OneDrive, Dropbox, and Mega, to act as command and control (C2) servers. Other backdoors utilize standard TCP connections to remote C2 servers or get commands to execute from files hosted on FTP servers.

T1095Non-Application Layer ProtocolEvidence1

TechnoCreep and POLONIUM’s reverse shell module use TCP.

T1105Ingress Tool TransferEvidence1

T1132.001Standard EncodingEvidence1

CreepySnail, CreepyDrive and some of POLONIUM’s reverse shell modules use base64-encoded commands to communicate with the C&C server.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Oct 11, 2022

Hacking group POLONIUM uses ‘Creepy’ malware against Israel

A modular custom POLONIUM backdoor written in C++ for cyberespionage. It separates command execution, C2 communication, upload, and download into components that can run independently and persist via separate scheduled tasks, making detection harder.

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A modular C++ backdoor with separate components for command execution, C2 communications, upload, and download. It uses raw TCP sockets with fake HTTP-like wrapping and persists via scheduled tasks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

PapaCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

PapaCreep is a previously undocumented custom backdoor written in C++ that can receive and execute commands from a remote server via TCP sockets.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.003Virtual Private ServerEvidence1

POLONIUM has acquired various servers for C&C and also for storing exfiltrated files.

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

The advantage is that the components can run independently, persist via separate scheduled tasks in the breached system, and make the backdoor harder to detect.

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

T1129Shared ModulesEvidence1

DeepCreep and MegaCreep have their code divided into small DLLs, which are loaded both statically and dynamically.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

The advantage is that the components can run independently, persist via separate scheduled tasks in the breached system, and make the backdoor harder to detect.

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

The advantage is that the components can run independently, persist via separate scheduled tasks in the breached system, and make the backdoor harder to detect.

T1053.005Scheduled TaskEvidence1

DeepCreep, MegaCreep and FlipCreep create scheduled tasks for persistence.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence1

T1125Video CaptureEvidence1

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

T1095Non-Application Layer ProtocolEvidence1

TechnoCreep and POLONIUM’s reverse shell module use TCP.

T1105Ingress Tool TransferEvidence1

T1132.001Standard EncodingEvidence1

CreepySnail, CreepyDrive and some of POLONIUM’s reverse shell modules use base64-encoded commands to communicate with the C&C server.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Oct 11, 2022

Hacking group POLONIUM uses ‘Creepy’ malware against Israel

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A modular C++ backdoor with separate components for command execution, C2 communications, upload, and download. It uses raw TCP sockets with fake HTTP-like wrapping and persists via scheduled tasks.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.