Skip to content
MalwareWiki

Loader

Seduploader

aka jhuhugit · jkeyskw · downrage · carberplike · GAMEFISH

simple tool to facilitate download and persistence of a next-stage tool; collects system information and metadata probably in an attempt to tell sandbox-environments apart from real targets on the ser

Seduploader, also known as jhuhugit, jkeyskw, downrage, carberplike, is a Windows loader operated by APT28.

Background

A lightweight tool that handles the download and persistence of a follow-on payload. It gathers system details and metadata, likely so the server side can distinguish sandbox environments from genuine targets, and pings search-engine domains such as Google to verify Internet connectivity. Its strings are obfuscated with a XOR scheme using a 16-byte key.

Source: Malpedia (Fraunhofer FKIE).