Malware: DownPaper

Description

[DownPaper](https://attack.mitre.org/software/S0186) is a backdoor Trojan; its main functionality is to download and run second stage malware. (Citation: ClearSky Charming Kitten Dec 2017)

External References

• mitre-attack
• ClearSky Charming Kitten Dec 2017

Techniques Used by This Malware

• T1012 — Query Registry
• T1033 — System Owner/User Discovery
• T1059.001 — PowerShell
• T1059.003 — Windows Command Shell
• T1071.001 — Web Protocols
• T1082 — System Information Discovery
• T1547.001 — Registry Run Keys / Startup Folder

APT Groups Using This Malware

• Magic Hound