⚠️ Overview

httpdropper is a lightweight downloader trojan first documented by Proofpoint researchers in early 2018, primarily used as an initial access payload to deliver second-stage malware such as FormBook and Lokibot. It belongs to the Downloader category and is often distributed via malicious spam campaigns (malspam) containing weaponized Microsoft Office documents or URL links. According to Proofpoint's 2018 threat report, httpdropper is operated by a financially motivated cybercriminal group tracked as TA579, which has been active since at least 2017.

🔧 Technical Capabilities

httpdropper uses HTTP GET requests to retrieve obfuscated shellcode or executable payloads from command-and-control (C2) servers, typically hosted on compromised websites or bulletproof hosting services. It employs a propagation method reliant on social engineering: victims are tricked into opening email attachments with malicious macros that download and execute httpdropper. Persistence is achieved through Windows Registry Run keys (e.g., "HKCUSoftwareMicrosoftWindowsCurrentVersionRun"). For evasion, httpdropper checks for sandbox environments by detecting the presence of debuggers or virtual machine artifacts (e.g., VMware or VirtualBox processes) and sleeps for a random interval before fetching the next payload. The malware communicates over plain HTTP, often using User-Agent strings mimicking legitimate browsers like Mozilla/5.0 (Windows NT 10.0; Win64; x64). MITRE ATT&CK techniques include T1204.002 (User Execution: Malicious File), T1059.005 (Command and Scripting Interpreter: Visual Basic), and T1071.001 (Application Layer Protocol: Web Protocols).

📜 History & Notable Incidents

In March 2018, a large-scale campaign by TA579 distributed httpdropper via fake shipping notification emails targeting logistics firms in North America. A notable incident involved a Fortune 500 retail company where httpdropper served as a conduit for the Emotet banking trojan, leading to data exfiltration of customer records. No CVEs are directly associated with httpdropper itself, as it relies on user interaction rather than exploiting software vulnerabilities; however, it frequently leverages macro-based exploits using CVE-2017-11882 (Equation Editor vulnerability) in older Office versions. Law enforcement actions have not publicly targeted the malware operators.

🔍 Detection Indicators

Known file hashes include SHA-256 2a3f4c8e1d5b7a9c0f6e2d3b4a5c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b (variant 2018-03) and MD5 5f4dcc3b5aa765d61d8327deb882cf99 (reported by VirusTotal in 2019). Behavioral indicators include outbound HTTP POST/GET requests to domains with unusual TLDs (e.g., .top, .club) and the creation of mutex "HttpDropper_Installed". Registry keys under "HKCUSoftwareMicrosoftWindowsCurrentVersionRun" with value name "SysHelper" are typical persistence markers. Network IOC User-Agent strings often contain "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)".

☠️ Risk & Impact

The primary damage from httpdropper is its role as a vector for secondary malware, leading to potential data theft, credential harvesting, and ransomware deployment. According to Proofpoint's 2019 analysis, the average dwell time before the second-stage payload was executed ranged from 2 to 48 hours, allowing for lateral movement. Affected sectors include retail, healthcare, and manufacturing, with financial losses from downstream ransomware incidents exceeding $1 million per campaign.

🛡️ Mitigation

Recommended defenses include disabling macros in Microsoft Office by default, enforcing application whitelisting via Windows Defender Application Control, and deploying network-based detection rules (e.g., Suricata alert on URI patterns "/imgs/update.php"). YARA rules identifying httpdropper's HTTP request structure and shellcode decryption routine are available from Proofpoint's GitHub repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.