Tool: ArtraDownloader| Names | ArtraDownloader | |
| Category | Malware | |
| Type | Downloader | |
| Description | (Palo Alto) Overall, the ArtraDownloader malware family is not sophisticated, leveraging simple registry keys for persistence and HTTP requests to download and execute a remote file. Important strings within these samples are obfuscated by adding or subtracting from each byte within a string. This same obfuscation routine is used when sending data via HTTP. This downloader has frequently been observed downloading the Remote Access Trojan (RAT) BitterRAT which is associated with BITTER threat operations. | |
| Information | <https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/> | |
| Malpedia | <https://malpedia.caad.fkie.fraunhofer.de/details/win.artra> | |
| AlienVault OTX | <https://otx.alienvault.com/browse/pulses?q=tag:ArtraDownloader> | |
Last change to this tool card: 22 April 2020
Download this tool card in JSON format
Previous: ARTFULPIE
Next: Aryan
| Changed | Name | Country | Observed | ||
APT groups | |||||
| Bitter | [South Asia] | 2013-Dec 2020 | |||
| Patchwork, Dropping Elephant |  | 2013-Mar 2018 | |||
2 groups listed (2 APT, 0 other, 0 unknown)
|
Thailand Computer Emergency Response Team (ThaiCERT) Follow us on
|
Report incidents |
|
 |
+66 (0)2-123-1234 | |
 |
report@thaicert.or.th | |
 |
Download PGP key | |