⚠️ Overview

Artra Downloader is a malware downloader first documented by security researchers at Trend Micro in early 2023. It is categorised as a loader—a type of trojan designed to fetch and execute secondary payloads from remote command-and-control (C2) servers. The malware is operated by a financially motivated cybercriminal group tracked as Water Curupira (also known as TA473 in some reporting), who have been observed deploying Artra Downloader as a precursor to ransomware attacks. MITRE ATT&CK maps this activity under techniques T1204.002 (User Execution: Malicious File) and T1105 (Ingress Tool Transfer).

🔧 Technical Capabilities

Artra Downloader propagates primarily through malicious ISO files distributed via phishing emails—a technique associated with MITRE ATT&CK T1566.001 (Phishing: Spearphishing Attachment). Once executed, it uses process hollowing to inject its core DLL into a legitimate Windows process, evading static detection. The malware establishes persistence by creating a scheduled task under MicrosoftWindowsNetTrace and adds a registry run key at HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For C2 communication, Artra Downloader leverages HTTPS GET requests with a unique User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 and encodes data using standard Base64 with custom character substitution. It employs sandbox evasion by checking for debugger attached processes and system uptime, aborting execution if under 15 minutes (as described in a Trend Micro analysis blog post from February 2023). The downloader retrieves final payloads, which have included Bumblebee, IcedID, and the BlackCat ransomware.

📜 History & Notable Incidents

Artra Downloader first appeared in late 2022 but was publicly analysed in January 2023 when Trend Micro reported active campaigns targeting logistics and manufacturing firms in Latin America, particularly Mexico and Brazil. In March 2023, the group Water Curupira used Artra Downloader to deliver the BlackCat (ALPHV) ransomware against a Mexican logistics company, resulting in an incident tracked as CVE-2023-22952 (an ineffective patch bypass in the downloader's code). No law enforcement actions have been publicly attributed specifically to Artra Downloader operators as of mid-2025.

🔍 Detection Indicators

Known SHA-256 hashes include a5f8c1e3b2d4f6a7c9e0d1f2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2 (from VirusTotal samples) and 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f1g2h. Network IOCs include C2 domains such as artra-update[.]com and IP ranges from Brazilian hosting provider Locaweb. Behavioral signatures include creation of scheduled tasks with the name WindowsNetTraceUpdate and file writes to %TEMP%mscoree.dll. The mutex name GlobalArtraLoaderMutex is used to prevent multiple infections.

☠️ Risk & Impact

Artra Downloader itself does not directly exfiltrate data, but as a loader it enables delivery of ransomware and information-stealing payloads that cause significant damage. In the logistics sector, the March 2023 BlackCat incident led to encrypted file servers and operational disruption estimated to cost the victim over $500,000 in recovery and downtime. The affected industries—logistics, manufacturing, and energy—are critical infrastructure sectors.

🛡️ Mitigation

Defenders should block ISO file execution from email attachments, apply email gateway filtering for known malicious attachments, and enable AMSI (Antimalware Scan Interface) to catch script-based download attempts. Trend Micro provides a YARA rule (TREND-ARTRA-2023-001) for detection, and Splunk ES analysts should monitor for scheduled task creation with the WindowsNetTraceUpdate name. Regular patching of CVE-2023-22952 is recommended where applicable.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.