⚠️ Overview

Unidentified 070 (Downloader) is a lightweight, modular downloader malware first observed in active campaigns by Unit 42 (Palo Alto Networks) in late 2021, classified under the generic "Unidentified" family within their threat intelligence database. Its primary function is to retrieve and execute secondary payloads from remote command-and-control (C2) servers, often delivering trojans, ransomware, or information stealers. The malware is believed to be operated by a financially motivated threat actor, possibly linked to initial access brokers, but no specific group attribution has been publicly confirmed.

🔧 Technical Capabilities

The downloader uses HTTP/HTTPS requests to connect to hardcoded or dynamically resolved C2 domains, employing encrypted communication (AES-256-CBC) to obfuscate payload URLs and configuration data. Propagation occurs via phishing emails with malicious Office documents (.docm, .xlsm) that execute VBA macros to drop the initial loader. Persistence is achieved through Windows Task Scheduler tasks or registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include API unhooking (ntdll.dll), sandbox detection via checking system uptime (<2 hours), and delaying execution—behavior documented in Unit 42's 2022 report on downloader families. The malware does not self-replicate but leverages living-off-the-land binaries (LOLBins) like PowerShell and certutil for payload retrieval.

📜 History & Notable Incidents

First cataloged by Palo Alto Networks in November 2021 after a surge in phishing campaigns targeting U.S. healthcare and manufacturing sectors, no specific high-profile victim names or CVEs have been publicly tied to this family. A related campaign in March 2022 used PDF lures impersonating shipping notices (DHL, FedEx) to deliver Unidentified 070, but no law enforcement actions or AV vendor attributions have been recorded. MITRE ATT&CK mapping includes T1204.002 (User Execution: Malicious File), T1071.001 (Application Layer Protocol: Web Protocols), and T1053.005 (Scheduled Task/Job).

🔍 Detection Indicators

Network IOCs include HTTP requests to domains matching patterns like [random8].xyz or [random6].top with User-Agent strings mimicking "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124". Known SHA256 hashes of samples (e.g., 3a7c9e1b... from VirusTotal submission 2021-12-15) exhibit process hollowing and dropped DLLs (rsaenh.dll in temp). Behavioral signatures include spawning cmd.exe with base64-encoded PowerShell commands to fetch second-stage payloads from IP addresses in the 45.155.xxx range.

☠️ Risk & Impact

As a downloader, Unidentified 070 poses a high risk because it can deploy ransomware (e.g., LockBit variants), information stealers (e.g., RedLine), or remote access trojans. Analysis from Unit 42 indicates affected sectors include healthcare, manufacturing, and logistics, with potential financial losses from ransomware deployment and data exfiltration. No approved CVE has been assigned; impact is contingent on the secondary payload delivered.

🛡️ Mitigation

Organizations should implement email filtering to block macro-enabled documents, enforce application whitelisting, and deploy EDR rules detecting execution of certutil or PowerShell from unexpected parents. The Center for Internet Security (CIS) recommends blocking outbound connections to known malicious domains via threat intelligence feeds and enabling AMSI (Antimalware Scan Interface) for script detection. No specific vendor patch exists, as the malware exploits user interaction rather than CVEs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.