pngdowner

MITRE ATT&CK: S0067 View on attack.mitre.org

Aliases: pngdowner

First seen
2014-05-01 00:00:00
Malware type
downloader
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 15:44:41

Targeted industries: defense-and-aerospace government-and-public-sector

Targeted regions: country_code:us country_code:cn

Context

pngdowner is malware used by Putter Panda. It is a simple tool with limited functionality and no persistence mechanism, suggesting it is used only as a simple "download-and- execute" utility.

Detection coverage

  • 1 YARA rules
  • 64 Sigma rules

Malware & tools used

  • Web Protocols (attack-pattern)
  • File Deletion (attack-pattern)
  • Credentials In Files (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Pngdowner_Auto (yara-rule)

Reports & references

  • cdn0.vox-cdn.com — Crowdstrike Intelligence Report Putter Panda.Original (report)
  • MITRE ATT&CK — G0024 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Pngdowner (report)
  • iocbucket.com — 7F7999Ab7F223409Ea9Ea10Cff82B064Ce2A1A31 (report)
  • MITRE ATT&CK — S0067 (report)

External references