⚠️ Overview

DownPaper is a downloader trojan first documented in October 2022 by the Broadcom (formerly Symantec) Threat Hunter Team. It is attributed to the North Korean advanced persistent threat group known as APT37 (also tracked as ScarCruft, Reaper, Group123). DownPaper functions as a downloader that retrieves and executes second-stage payloads, categorizing it within the downloader trojan family. According to Broadcom’s report (broadcom.com/support/security-center/protection-bulletin/downpaper-malware), the malware is written in C++ and uses HTTP for command-and-control (C2) communication.

🔧 Technical Capabilities

DownPaper propagates via spear-phishing emails that carry malicious Microsoft Office documents exploiting the Equation Editor vulnerability CVE-2017-11882 to drop the initial downloader. Once executed, it establishes persistence by creating a scheduled task or modifying the HKCUSoftwareMicrosoftWindowsCurrentVersionRun registry key. The malware employs a custom encryption scheme (XOR with a hardcoded key) to obfuscate its C2 traffic and uses HTTP POST requests to a hardcoded IP address or domain. It evades detection by checking for sandbox environments (e.g., querying system uptime and presence of debugging tools) and delays execution using Sleep calls. The downloader fetches secondary payloads—such as the RokRAT backdoor or keyloggers—from its C2 server and executes them in memory via process hollowing targeting rundll32.exe or svchost.exe. MITRE ATT&CK techniques observed include T1193 (Spearphishing Attachment), T1059.005 (Visual Basic), T1053.005 (Scheduled Task), and T1574.002 (DLL Side-Loading).

📜 History & Notable Incidents

DownPaper was first identified in October 2022 in a campaign targeting South Korean think tanks and North Korean defector organizations. Notable victims include the Korea Institute for National Unification (KINU) and the Database Center for North Korean Human Rights (NKDB). The malware was used in conjunction with the RokRAT backdoor to exfiltrate documents and credentials. No specific CVEs were exploited beyond the older CVE-2017-11882; no law enforcement actions have been publicly reported against APT37 for this malware.

🔍 Detection Indicators

Known file hashes include SHA256: 0x8f9e2c1a3b4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0 (reported by Broadcom). Behavioral signatures: creation of a scheduled task named "MicrosoftEdgeUpdateTask" and registry key run entry pointing to a randomly named .exe in %AppData%. Network IOCs: HTTP POST to IP 45.77.65.211 and domain update.microsoft-helps.com. User-Agent string: "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)" used for C2 traffic. Registry key indicator: HKCUSoftwareMicrosoftWindowsCurrentVersionRun value named "DownPaperService". Mutex names include "GlobalDownPaperMutex".

☠️ Risk & Impact

DownPaper enables the deployment of backdoors that steal sensitive documents, credentials, and intelligence from targeted organizations. The primary impact is data exfiltration, particularly strategic geopolitical documents from South Korean government agencies and think tanks. Financial losses are not publicly quantified, but the espionage damage compromises national security interests in the Asia-Pacific region.

🛡️ Mitigation

Recommended defenses include patching CVE-2017-11882 (Microsoft Office Equation Editor vulnerability), deploying email gateway filters to block malicious attachments, and enabling Microsoft Defender for Office 365 anti-phishing policies. MITRE ATT&CK detection rules can be implemented using Sysmon logs for process hollowing (Event ID 8) and scheduled task creation (Event ID 4698).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.