Mailcheck
Overview
Executive Summary
MailCheck (often detected as HackTool.MailChecker, Riskware.MailCheck, or Trojan.AccountChecker) is a category of illicit utility software utilized by cybercriminals to perform automated, bulk validation of stolen email credentials (combo lists). These tools are a critical component of the underground credential stuffing ecosystem, allowing attackers to rapidly verify which stolen "username:password" pairs are currently active and valid for various email providers (Gmail, Outlook, Yahoo, etc.).Infection Vector and Technical Capabilities
MailCheck tools are not typically self-replicating malware. They are standalone executables or Python scripts downloaded intentionally by an attacker or a malicious insider who has acquired a database of stolen credentials from a dark web forum. Upon execution, the tool automates the credential validation process:- Proxy Integration: To avoid rate-limiting, CAPTCHAs, and IP bans from the targeted email providers, MailCheck tools heavily integrate with massive lists of rotating SOCKS/HTTP proxies. This distributes the login attempts across thousands of IP addresses.
- Automated Authentication (IMAP/POP3/SMTP/Web): The tool ingests the combo list and rapidly attempts to authenticate against the targeted email provider's servers. It may use standard mail protocols (IMAP/POP3) or attempt to interact directly with the provider's web login API.
- Sorting and Output: The tool categorizes the results, generating text files separating the "Valid" (successful logins) accounts from the "Invalid" or "Locked" accounts. The attacker then uses the valid list for spamming, identity theft, or reselling on illicit markets.
Threat Assessment
The detection of a MailCheck utility on a corporate endpoint is a critical indicator of active, financially motivated cybercrime. It signifies that the user (or an attacker controlling the machine) is actively engaging in credential stuffing attacks utilizing corporate network infrastructure, posing severe legal and reputational risks.Incident Response and Remediation
- Immediate Legal and HR Escalation: Isolate the endpoint immediately, but do not power it off to preserve volatile memory. Because the tool is used for explicit fraud/hacking, this incident must be immediately escalated to HR and Legal counsel.
- Forensic Chain of Custody: Treat the endpoint as a crime scene. A full forensic image of the hard drive must be captured to determine the origin of the combo lists and identify which specific email providers the attacker was targeting.
- Network Auditing: Review the corporate firewall logs for massive spikes in outbound traffic to IMAP/POP3 ports or anomalous DNS requests to proxy services, correlating this activity with the infected endpoint.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1110.004 T1090
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_MAILCHECK {
meta:
description = "Detects Mailcheck (trojan)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "mailcheck" ascii wide nocase
$s2 = "hacktool.mailchecker" ascii wide nocase
$s3 = "riskware.accountchecker" ascii wide nocase
$s4 = "tool.combochecker" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Mailcheck Activity
id: 40661098a914ec1ba5d02252d863f8e5
status: experimental
description: Detects generic indicators of the mailcheck malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*mailcheck*"
- "*hacktool.mailchecker*"
- "*riskware.accountchecker*"
- "*tool.combochecker*"
condition: selection
level: mediumReferences & External Analysis
- Search "mailcheck" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Mailcheck Trojan from Windows?
Manual removal of Mailcheck is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Mailcheck a virus or a Trojan?
Mailcheck is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Mailcheck typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Mailcheck infection?
Symptoms of Mailcheck can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: trojan)
Explore other malware families in the same category:
Protect Your Network Against Trojans
Want to prevent Mailcheck and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/mailcheck.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.