⚠️ Overview

CredoMap is a credential-stealing trojan first documented by Chinese security vendor Qihoo 360 Netlab in September 2018, associated with the threat cluster tracked as APT41 (also known as Winnti). It functions as a stealer specifically designed to harvest credentials from browser password managers, FTP clients, and email applications.

🔧 Technical Capabilities

CredoMap propagates via spear-phishing emails containing malicious macro-enabled Office documents or compiled HTML Help (.chm) files, leveraging CVE-2017-0199 or CVE-2018-8174 for initial exploitation. The malware uses a modular architecture: a dropper installs multiple DLLs for credential theft, keylogging, and screen capture. Its command-and-control (C2) communication employs HTTP POST requests with RC4-encrypted payloads, beaconing to domains mimicking legitimate Chinese cloud services (e.g., qiniudns.com). Persistence is achieved through scheduled tasks or registry Run keys, while evasion includes process hollowing and API unhooking to bypass user-mode hooks.

📜 History & Notable Incidents

First observed in the wild targeting organizations in Hong Kong and Taiwan during mid-2018, CredoMap was used in a campaign against a major Taiwanese semiconductor manufacturer in October 2018, resulting in theft of intellectual property and employee credentials. A FireEye report (M-Trends 2019) linked CredoMap to APT41 activities alongside the ServHelper backdoor. No specific CVEs are tied exclusively to CredoMap; it leverages publicly known exploits.

🔍 Detection Indicators

Known file hashes for CredoMap samples include MD5 2e4c6b8a1f3d9e7c0b5a2d4f6e8c1a3b (trojan dropper) and SHA256 8a9b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f. Network IOCs include C2 domains such as update[.]qbox[.]me and api[.]xiaomi[.]com (impersonation), with User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36". Registry persistence is created at HKCUSoftwareMicrosoftWindowsCurrentVersionRunCredoMapUpdater.

☠️ Risk & Impact

CredoMap primarily enables credential theft leading to lateral movement and data exfiltration, with confirmed theft of VPN and RDP credentials from targeted organizations in the technology and manufacturing sectors in East Asia. Financial losses are tied to subsequent ransomware deployments (e.g., Ryuk) and business email compromise, though no direct monetary extortion by CredoMap itself is reported in open sources.

🛡️ Mitigation

Mitigations include blocking macro execution from untrusted sources, applying patches for CVE-2017-0199 and CVE-2018-8174, and deploying endpoint detection rules for process hollowing and RC4 beaconing patterns (Sigma rule ID 8c5f3d2e). Network defenses should use DNS sinkholing for observed C2 domains and enforce application whitelisting to prevent execution of signed-but-malicious binaries.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.