Loading malware…
Downloader1 is an initial-stage downloader identified by JPCERT/CC in APT-C-60 campaigns observed in Japan from June through August 2025. It is the file WebClassUser.dat, which is created after a spearphishing infection chain in which attackers impersonate job applicants and send recruitment staff a malicious VHDX attachment. Opening an embedded LNK executes a legitimate Git component (gcmd.exe) to run a script that displays a decoy document, drops additional files, and installs Downloader1.
Downloader1 establishes persistence and execution through COM hijacking by registering an InProcServer32 value under HKCU\Software\Classes\CLSID{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32. It periodically communicates with the legitimate analytics service StatCounter, using request headers including a Referer value derived from the victim’s volume serial number and computer name so operators can identify compromised hosts. It then constructs victim-specific GitHub raw URLs, including examples under raw.githubusercontent.com repositories such as carolab989/class2025, to retrieve a tasking file named [VolumeSerialNumber+ComputerName].txt.
That GitHub-hosted tasking file enables per-host control after the attacker observes the StatCounter beacon. Reported commands include changing or resetting the StatCounter beacon interval, instructing a DLL download, and directing retrieval of a second-stage downloader. Downloader1 XOR-decodes retrieved content using the key string "sgznqhtgnghvmzxponum" before execution. It is associated with staged delivery of Downloader2, which in turn downloads and executes SpyGlace and its loader.
High-confidence associated infrastructure and behaviors include abuse of legitimate services (StatCounter and GitHub), victim identification based on volume serial number plus computer name, and use in APT-C-60 operations targeting organizations in Japan via recruitment-themed spearphishing. A directly reported persistence IOC is the registry path HKCU\Software\Classes\CLSID{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32, and a directly reported file artifact is WebClassUser.dat.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The created WebClassUser.dat (hereafter referred to as “Downloader1”)… gets persisted and executed through COM hijacking.”
12 distinct techniques documented for this family, organized by ATT&CK tactic.
「求職者を装い組織の採用担当に宛てた標的型攻撃メール…今回の攻撃では悪性のVHDXファイルが直接添付ファイルとして送られていました。」
「Gitによって実行されるスクリプトはデコイ文書の表示、ファイルの作成、実行を担い…」
「メールの受信者がVHDXファイル内に含まれているLNKファイルをクリックすることで…悪性のスクリプトが動作します。」
「VHDXファイル内に含まれているLNKファイルをクリック…」
「…レジストリへ登録され… HKCU\Software\Classes\CLSID\{...}\InProcServer32」
「…WebClassUser.dat…次に示すレジストリへ登録され、COMハイジャッキングによって永続化および実行」「HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32」
「…WebClassUser.dat…次に示すレジストリへ登録され、COMハイジャッキングによって永続化および実行」「HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32」
「取得したファイルは…XORデコード後に実行」「SpyGlaceは…BASE64とRC4…改変されたRC4」「AES128-CBCにて復号」
「正規ファイルであるGit経由で悪性のスクリプトが動作… gcmd.exe(Gitの正規ファイル)が実行され… type glog.txt | gcmd.exe」
「…レジストリへ登録され… HKCU\Software\Classes\CLSID\{...}\InProcServer32」
「a002=[md5(systeminfo)]」「[ComputerName;UserName;CpuInfo;OS Version;SpyGlace Version]」
「statcounter…に対して一定間隔で通信」「リクエストヘッダー…Referer: ONLINE=>…」「C2サーバーとの通信にBASE64とRC4を使用…リクエストヘッダーのフォーマット…」
「攻撃者はペイロードの配布にGitHubを使用…」「Downloader1はstatcounterという正規の統計サービスに対して一定間隔で通信」
「https://raw.githubusercontent.com/.../[VolumeSerialNumber + ComputerName].txt…その取得したファイルに記載されているURLを元に次のDownloader2のダウンロードおよび実行」
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.