H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DownPaper](https://attack.mitre.org/software/S0186) is a backdoor Trojan; its main functionality is to download and run second stage malware. (Citation: ClearSky Charming Kitten Dec 2017)

Labels

malware

8 recorded

Relationships

uses

to PowerShell

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from Magic Hound

Group

3 external

References

mitre-attack

S0186

open

DownPaper

—

ClearSky Charming Kitten Dec 2017

http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf

open