DownPaper — Malware Profile

DownPaper is a backdoor Trojan; its main functionality is to download and run second stage malware.

MITRE ATT&CK techniques (7)

• T1012 Query Registry
• T1033 System Owner/User Discovery
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1547.001 Registry Run Keys / Startup Folder

Attributed threat actors

• APT35

Read the full analysis on IntelFusions