Home > List all groups > List all tools > List all groups using tool DownPaper

Threat Group Cards: A Threat Actor Encyclopedia

Names	DownPaper
Category	Malware
Type	Downloader
Description	(ClearSky) DownPaper, sometimes delivered as sami.exe, is a Backdoor trojan. Its main functionality is to download and run a second stage.
Information	<https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf>
MITRE ATT&CK	<https://attack.mitre.org/software/S0186/>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.downpaper>

Last change to this tool card: 23 April 2020

Download this tool card in JSON format

Changed	Name	Country	Observed
APT groups
	Bahamut	[Middle East]	2016-Jul 2023
	Magic Hound, APT 35, Cobalt Illusion, Charming Kitten		2012-Jun 2025

2 groups listed (2 APT, 0 other, 0 unknown)

APT groups