{
  "family": "mepaow",
  "sample_count": 68,
  "category": "trojan",
  "description": "Mepaow (cataloged in antivirus vendor databases and threat intelligence feeds under detections including Trojan:Win32/Mepaow, Worm.Win32.MEPAOW, and Trojan.Mepaow) is a hybrid Windows trojan and worm active since 2012. Engineered to maintain persistent access across enterprise networks and consumer workstations, Mepaow spreads via infected removable USB media (leveraging autorun.inf scripts and deceptive shortcut files) as well as malicious email attachments. Once active, Mepaow copies itself into system directories under randomized filenames, registers autostart keys under Windows CurrentVersion\\Run, and injects surveillance threads into legitimate operating system processes. It records active user windows, hooks keyboard inputs to capture credentials, and establishes beaconing sessions with attacker-controlled command servers over HTTP to download secondary malicious binaries.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Mepaow",
    "Worm.Win32.MEPAOW",
    "Trojan.Mepaow",
    "Win32/Mepaow"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Mepaow?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mepaow is a hybrid Windows trojan and worm that spreads via USB drives, logs keystrokes, and stages secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mepaow propagate across removable USB drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It copies hidden executables onto attached drives and creates deceptive LNK shortcuts to trick users into execution."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Mepaow include?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors active application titles, hooks keystrokes, and captures system architecture details."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mepaow maintain persistence across system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds autostart values to the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do you remediate a Mepaow infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clean infected USB media, run an offline antimalware scan with Microsoft Defender, and remove startup registry entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1056.001",
    "T1547.001",
    "T1105",
    "T1055",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Mepaow from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Mepaow persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Mepaow attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Mepaow modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Mepaow dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Credential Theft & Network Propagation",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Removable USB Media (LNK / Autorun)",
    "Malicious Email Attachments",
    "Peer-to-Peer File Sharing"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "USB Removable Drive Replication",
    "Keystroke Logging",
    "Process Thread Injection",
    "Secondary Payload Downloading",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "LNK Shortcut",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Periodic HTTP GET requests beaconing to remote C2 IP endpoints",
      "Binary downloads from compromised WordPress sites"
    ],
    "evasion_techniques": [
      "Hiding malicious files on USB drives with hidden/system attributes",
      "Randomizing dropped payload names in %AppData%"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MepaowService",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinHostManager"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Removable drive contamination, keystroke theft, secondary payload deployment"
  },
  "lineage": {
    "derived_from": [
      "Win32 Worm & Surveillance Hybrid Toolkits"
    ],
    "variants": [
      "Mepaow.AA",
      "Mepaow.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b",
      "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c"
    ],
    "delivery": [
      "usb_setup.exe",
      "document_photo.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MepaowUpdate",
      "%AppData%\\Mepaow\\mepaow.exe"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Worm.Win32.MEPAOW",
      "url": "https://www.trendmicro.com"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Mepaow",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mepaow"
    }
  ]
}