mailcreep | 75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a

General

Target
75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a
Size 5.8MB
Sample260910-leqnls1dmg
SHA256 75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a
MD5 39e6cd3e098a0c23f1695e3e8ad4a30c
SHA1 51464b80478fe64ad66480dd4e683bb60016f9cb
SHA512 ba11c2fe6da51484979096b947f6e71d1bc5a7ac05c968f91110c5135c68477726c1d373afe9d4636de6337e8f4b95560b3f9b13f921d1f3d054b586488941e0
SSDEEP 49152:dzDFgotADCdKEM/LcG7PYA6EAnFi3Ab05i1/iHr6FYbdRb7ldpI0Z5E:dttADCUXjtjBARaiwRisE
TLSH
T134563901FECB55FAEA071970416BB26F63306D054F24CBDBEB447B6AE837A911C36246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt apt36 backdoor mailcreep

Malware Config

Signatures

Family: MAILCREEP
MAILCREEP is a Golang-based backdoor leveraging the Microsoft Graph API for its C2 communications.
backdoor mailcreep

Detects MailCreep Backdoor 1 IoCs

apt apt36

resource	yara_rule
sample	family_mailcreep

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a

File Explorer

75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a

.exe 5.8MB

75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a

IMPHASH 1aae8bf580c846f39c71c05898e57e88
SHA256 75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a
MD5 39e6cd3e098a0c23f1695e3e8ad4a30c
SHA1 51464b80478fe64ad66480dd4e683bb60016f9cb
SHA512 ba11c2fe6da51484979096b947f6e71d1bc5a7ac05c968f91110c5135c68477726c1d373afe9d4636de6337e8f4b95560b3f9b13f921d1f3d054b586488941e0
SSDEEP 49152:dzDFgotADCdKEM/LcG7PYA6EAnFi3Ab05i1/iHr6FYbdRb7ldpI0Z5E:dttADCUXjtjBARaiwRisE
TLSH
T134563901FECB55FAEA071970416BB26F63306D054F24CBDBEB447B6AE837A911C36246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MailCreep Backdoor

apt apt36
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

511984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

274KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

75486f49ef3a7523bd6fa04a2fa278f7ea9422463d21c596de3c883c8562f56a

kernel32

generic