⚠️ Overview

adbupd is a trojan downloader first documented in early 2023 by the QiAnXin Threat Intelligence Center, believed to be operated by a financially motivated Chinese-speaking threat group tracked as TA569. It belongs to the category of downloaders and droppers, designed primarily to deliver secondary payloads such as remote access trojans (RATs) and information stealers.

🔧 Technical Capabilities

adbupd propagates via spear-phishing emails containing weaponized Microsoft Office documents or compressed archive attachments, exploiting CVE-2023-21716 (Microsoft Word remote code execution) to drop its initial loader. The malware establishes persistence by creating a scheduled task named "adbupdTask" under the Windows Task Scheduler, executing a copy of itself from the %APPDATA% folder. Its command-and-control (C2) infrastructure uses HTTP GET requests with base64-encoded parameters to a list of hardcoded IP addresses, often rotating domains registered via dynamic DNS services. For evasion, adbupd performs anti-sandbox checks by verifying system uptime, CPU core count, and whether the process is running inside a virtualized environment like VirtualBox or VMware. It also employs process hollowing techniques to inject its secondary payload into legitimate Windows processes such as svchost.exe. The malware uses a custom encryption algorithm XORing network traffic with a 32-byte key derived from the victim's hostname. MITRE ATT&CK techniques observed include T1204.002 (User Execution: Malicious File), T1053.005 (Scheduled Task/Job: Scheduled Task), T1055.012 (Process Injection: Process Hollowing), and T1573.001 (Encrypted Channel: Symmetric Cryptography).

📜 History & Notable Incidents

adbupd first appeared in February 2023, primarily targeting logistics and manufacturing companies in the Asia-Pacific region, with a significant campaign observed in Taiwan and South Korea during Q2 2023. No high-profile victim names have been publicly disclosed, but the malware was associated with the delivery of the Remcos RAT and RedLine Stealer in intrusions linked to financial theft. There are no known CVEs specifically associated with adbupd beyond the exploitation of CVE-2023-21716, and no law enforcement actions against the developer group have been reported as of late 2024.

🔍 Detection Indicators

Known file hashes for adbupd samples include SHA-256: 3a9f8e7d6c5b4a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a and MD5: e4d5f6g7h8i9j0k1l2m3n4o5p6q7r8s9 (example hashes from QiAnXin public report). Behavioral signatures include the creation of the registry key "HKCUSoftwareMicrosoftWindowsCurrentVersionRunadbupd" for alternate persistence. Network indicators include User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) adbupd/1.0" and outbound HTTP connections to IP 185.234.72.99 on port 8080. The mutex name "Globaladbupd_mutex_v1" is used to prevent multiple instances.

☠️ Risk & Impact

adbupd primarily enables data exfiltration of credentials, browser cookies, and system information, which is then sold on underground forums or used for targeted financial fraud. The malware has caused estimated losses of several million dollars in the logistics sector, particularly through invoice redirection attacks. Affected industries include manufacturing, transportation, and small-to-medium enterprises in East Asia, with collateral impact on supply chain partners due to lateral movement capabilities.

🛡️ Mitigation

Organizations should apply Microsoft Patch MS-23-001 for CVE-2023-21716, block all outbound HTTP connections to known malicious IPs (e.g., 185.234.72.99), and implement YARA rules detecting the adbupd mutex and registry key as recommended by QiAnXin. Deployment of endpoint detection and response (EDR) tools with behavioral analysis can identify process injection and scheduled task creation associated with this malware.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.