MalwareUsed by 1 actor

TechnoCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

TechnoCreep is a previously undocumented C# backdoor that communicates with a C&C server via TCP sockets.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.003Virtual Private ServerEvidence1

POLONIUM has acquired various servers for C&C and also for storing exfiltrated files.

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

their malicious activity includes the ability to log keystrokes, take screenshots of the desktop, take photos with the webcam, exfiltrate files from the host, install additional malware, and execute commands on the infected device.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

TechnoCreep sends a list of IP addresses associated with a victim’s computer.

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

T1082System Information DiscoveryEvidence1

TechnoCreep and POLONIUM’s reverse shell module send information such as computer name, username, and operating system to a remote server, in order to identify their victims.

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence1

T1125Video CaptureEvidence1

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Some backdoors abuse legitimate cloud services, such as OneDrive, Dropbox, and Mega, to act as command and control (C2) servers. Other backdoors utilize standard TCP connections to remote C2 servers or get commands to execute from files hosted on FTP servers.

T1095Non-Application Layer ProtocolEvidence1

TechnoCreep and POLONIUM’s reverse shell module use TCP.

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Oct 11, 2022

Hacking group POLONIUM uses ‘Creepy’ malware against Israel

A custom POLONIUM backdoor used for cyberespionage. Across these backdoors, capabilities include keylogging, screenshots, webcam capture, file exfiltration, installing additional malware, and remote command execution.

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A C# backdoor using raw TCP sockets for C2, capable of sending host information, receiving commands, uploading/downloading files, executing cmd.exe commands, and persisting via the Startup folder.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

TechnoCreep

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

POLONIUM

TechnoCreep is a previously undocumented C# backdoor that communicates with a C&C server via TCP sockets.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.003Virtual Private ServerEvidence1

POLONIUM has acquired various servers for C&C and also for storing exfiltrated files.

T1587.001MalwareEvidence1

POLONIUM has developed at least six backdoors and several other malicious modules.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

DeepCreep, MegaCreep, FlipCreep and TechnoCreep use cmd.exe to execute commands in a compromised computer.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

TechnoCreep sends a list of IP addresses associated with a victim’s computer.

T1033System Owner/User DiscoveryEvidence1

POLONIUM has executed whoami.exe to identify the logged-on user.

T1082System Information DiscoveryEvidence1

TechnoCreep and POLONIUM’s reverse shell module send information such as computer name, username, and operating system to a remote server, in order to identify their victims.

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence1

T1125Video CaptureEvidence1

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

T1095Non-Application Layer ProtocolEvidence1

TechnoCreep and POLONIUM’s reverse shell module use TCP.

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

DeepCreep, MegaCreep, FlipCreep and TechnoCreep exfiltrate files over the C&C channel via upload commands.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Oct 11, 2022

Hacking group POLONIUM uses ‘Creepy’ malware against Israel

eset welivesecurity blogNews

Oct 11, 2022

POLONIUM targets Israel with Creepy malware

A C# backdoor using raw TCP sockets for C2, capable of sending host information, receiving commands, uploading/downloading files, executing cmd.exe commands, and persisting via the Startup folder.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.