Skip to content

Hide Navigation Hide TOC

IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf)

IMAPLoader is a .NET-based loader malware exclusively associated with CURIUM operations since at least 2022. IMAPLoader leverages email protocols for command and control and payload delivery.(Citation: PWC Yellow Liderc 2023)

Cluster A Galaxy A Cluster B Galaxy B Level
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware 1
IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5) Attack Pattern 1
IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern 1
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware 1
AppDomainManager - T1574.014 (356662f7-e315-4759-86c9-6214e2a50ff8) Attack Pattern IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware 1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add) Attack Pattern IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware 1
IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware Hidden Window - T1564.003 (cbb66055-0325-4111-aca0-40547b6ad5b0) Attack Pattern 1
IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) Attack Pattern 1
IMAPLoader - S1152 (3058b264-fe6b-46be-8948-2d1fadaf8adf) Malware Mail Protocols - T1071.003 (54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b) Attack Pattern 1
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9) Attack Pattern Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) Attack Pattern 2
AppDomainManager - T1574.014 (356662f7-e315-4759-86c9-6214e2a50ff8) Attack Pattern Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern 2
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern Hidden Window - T1564.003 (cbb66055-0325-4111-aca0-40547b6ad5b0) Attack Pattern 2
Mail Protocols - T1071.003 (54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b) Attack Pattern Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern 2