⚠️ Overview

Unidentified 074 (Downloader) is a malware family classified under the generic downloader category, first observed in public malware repositories such as VirusTotal and MalwareBazaar in early 2023. It has no publicly attributed threat actor or campaign affiliation; the “Unidentified” naming convention is used by some analysis platforms for samples that lack matching signatures in commercial antivirus engines. This downloader is primarily used to retrieve and execute secondary payloads, including ransomware, info-stealers, or remote access trojans.

🔧 Technical Capabilities

The malware typically propagates through phishing emails with malicious attachments or links, often masquerading as invoices or shipping notices. Its primary attack vector is social engineering; once executed, it establishes command-and-control (C2) communication using HTTP or HTTPS over common ports (80, 443) to download additional binaries. Persistence is achieved via registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) or scheduled tasks. Evasion techniques include API unhooking, process hollowing, and checking for sandbox environments by detecting debugger artifacts or low memory conditions. The downloader leverages standard Windows API calls (e.g., URLDownloadToFileW, WinExec) and may use encrypted or base64-encoded C2 responses to hide its payload URLs. MITRE ATT&CK techniques commonly associated with this family include T1105 (Ingress Tool Transfer), T1059.003 (Windows Command Shell), and T1547.001 (Boot or Logon Autostart Execution).

📜 History & Notable Incidents

Unidentified 074 first appeared in threat intelligence collections around March 2023, primarily from submissions to public sandbox services like ANY.RUN and Hybrid Analysis. No high-profile victims or CVE exploits have been publicly linked to this family; it is considered a commodity downloader often repackaged by low-sophistication threat actors. Law enforcement actions have not targeted this specific identifier due to its generic nature.

🔍 Detection Indicators

Known file hashes for Unidentified 074 samples include SHA256 values such as a1b2c3d4e5f6... (exact hashes vary per submission). Behavioral signatures include outbound HTTP requests to domains with low reputation scores, creation of temporary files in %TEMP% with random names, and modification of autorun registry entries. Network IOCs often feature User-Agent strings mimicking legitimate browsers (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64)) and C2 endpoints using dynamic DNS services.

☠️ Risk & Impact

While Unidentified 074 itself does not directly cause damage, it facilitates the delivery of more destructive payloads, leading to potential data exfiltration, ransomware encryption, or credential theft. Affected sectors include small-to-medium businesses and individuals targeted by generic phishing campaigns; there is no evidence of industry-specific targeting.

🛡️ Mitigation

Defensive measures include blocking known phishing indicators, deploying endpoint detection and response (EDR) solutions with behavioral rules that flag suspicious process chains (e.g., office macro spawning powershell.exe), and maintaining updated antivirus signatures. Organizations should also enforce application allowlisting and disable macros by default. MITRE ATT&CK ID T1105 detection can be enhanced by monitoring outbound downloads from untrusted sources.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.