APT1 Freeware Lure Still Active 12 Years On, Live Cert Reveals

A Freeware Installer That Lies About What It Is — and Where It Calls Home

A 527-kilobyte Windows executable presents itself to the world as a routine archiving utility. Its internal product string reads "B1 Free Archiver Installer," its filename circulates as B1FreeArchiver_1.4.68.exe, and its copyright notice is dated 2013. None of that is what it is. Forty-three of 77 antivirus engines classify the binary as adware.catalina/downware — a trojanised installer that bundles unwanted payloads under a recognisable freeware brand — and three concurrent IDS rules confirm it was served over HTTP with its content-type spoofed as a JPEG image, a delivery sleight-of-hand designed to slip past perimeter controls that inspect file extensions rather than binary headers. What makes this campaign analytically notable in 2026 is not the installer itself, which dates to late 2013, but the infrastructure still running behind it: a Let's Encrypt certificate issued on 3 June 2026 and valid through 1 September 2026, covering b1.org and three subdomains, sits on an IP address that CTX Team has linked to this cluster — suggesting that whatever distribution or update channel this operation relies on remains live more than a decade after the payload first appeared on VirusTotal.

The campaign is attributed by CTX Team to Comment Crew (also tracked as APT1, Byzantine Candor, and Shanghai Group), with espionage as the stated motivation and education and research institutions in South Asia as the identified target profile. Attribution confidence is medium: the actor designation is not independently corroborated by public reporting. The analytical weight of this piece rests on the delivery tradecraft, the infrastructure fingerprint, and a significant evidence gap that leaves the full payload scope unresolved.

The Masquerade: How a Freeware Brand Becomes a Delivery Mechanism

The masquerading technique [T1036] at the heart of this campaign is straightforward in concept but carefully executed in detail. The PE32 executable carries an internal name of SmartInstaller, a product string of "B1 Free Archiver Installer," and a file version of 2, 4, 16, 0 — metadata that, taken together, presents a coherent identity as a legitimate software installer for the B1 Free Archiver utility, a real freeware product with a genuine user base. The binary's PE timestamp is 2013-11-11, and its first VirusTotal submission followed the next day, on 2013-11-12, indicating the file was built and deployed in rapid succession without any code-signing step — a detail that matters because the absence of a digital signature means there is no certificate chain to inspect or revoke.

The alt-name list associated with the file includes both SmartInstaller and B1FreeArchiver_1.4.68.exe, as well as a path string consistent with a clean-mx evidence archive (/var/www/clean-mx/virusesevidence/output.17100353.txt), which is consistent with the file having been flagged through a web-based malware distribution monitoring service. That path is a tell: clean-mx tracks malicious URLs, and the presence of its evidence-output path in the file's alt-names suggests the binary was caught in the wild being served from a web location — likely a software download site or a search-engine-optimised lure page targeting users querying for free archiving utilities.

The brand choice is operationally sensible. B1 Free Archiver is a cross-platform utility with genuine download traffic; a user searching for it and landing on a lookalike distribution page would have no obvious reason to distrust an installer that presents the correct product name, version string, and copyright year. The masquerade does not require technical sophistication — it requires only that the file's metadata be populated convincingly, which this sample achieves.

What the metadata cannot hide is the payload classification. The popular names associated with the file — catalina, downware, and unwantedx — reflect a consistent cross-engine consensus that the installer bundles adware or potentially unwanted application components. The threat label adware.catalina/downware is the majority verdict across the 43 flagging engines, and the overlay and runtime-modules PE tags are structurally significant: overlay indicates data appended beyond the PE's declared sections, a common dropper technique for carrying an embedded second-stage payload without exposing it to straightforward static analysis of the PE headers; runtime-modules suggests the installer loads additional components at execution time rather than shipping them as discrete files on disk.

The .text section of the PE registers an entropy of 6.63 — elevated but not at the ceiling values (above 7.5) typically associated with strong packing or encryption. The .rdata section comes in at 5.21 and .rsrc at 5.98, both within normal ranges for a compiled Windows application. The build provenance is anchored by imphash c805426348b451efda8350f2d205186b and vhash 055056655d155551f5z700817z7035z70400320306bz; the ssdeep fuzzy hash 12288:Dckw/7HgsutY+EKh3D2xjZNo/pWlvaTv/noPasH0WU:Ikw/DJjkD4jLo/YYTvsa2N provides a similarity baseline for analysts hunting related samples. Notably, the import count resolves to zero — an artefact of the analysis environment rather than a genuine absence of imports, likely reflecting that the binary's import table is resolved dynamically or that the overlay section was not fully unpacked before imports were enumerated.

Delivery Over HTTP: Three IDS Rules and a Content-Type Lie

The delivery mechanism is documented with unusual precision by three concurrent IDS rule hits, all fired against the same sample. The Suricata rule FILEEXT JPG file claimed identifies the specific deception: the binary was served with a content-type or file extension claiming it was a JPEG image. The Proofpoint Emerging Threats Open rules ET INFO EXE - Served Attached HTTP and ET INFO Packed Executable Download confirm the binary was transferred over unencrypted HTTP and that the receiving host's network stack observed a packed executable arriving under that JPEG cover. Two additional Suricata protocol-level rules — SURICATA STREAM excessive retransmissions and SURICATA HTTP unable to match response to request — fired in the same session, suggesting the HTTP transaction was not clean, possibly reflecting a non-standard server implementation or deliberate protocol manipulation.

The content-type spoofing technique [T1105] is a perimeter-evasion approach that targets security controls relying on MIME type or file extension inspection rather than magic-byte analysis. A proxy or web filter configured to block .exe downloads but pass .jpg requests will not catch this delivery. The technique is not novel, but its documentation here through three independent rule signatures — from two different rule sources — gives the delivery pattern unusually strong evidentiary grounding.

Three medium-severity Sigma rule matches are also recorded against the sample, though the specific Sigma rule names are not enumerated here. Their presence at medium severity is consistent with the installer's behavioural profile: not an immediate high-confidence malware verdict from a behavioural standpoint, but enough anomalous signal to warrant analyst review in a properly tuned detection environment.

The HTTP delivery context matters for understanding the target population. Users who download software over unencrypted HTTP in 2013 — the period of the installer's original distribution — were not unusual; HTTPS adoption for software distribution was far from universal at that time. A user seeking a free archiving utility, landing on a page serving the installer with a plausible filename and product description, would have had limited technical means to verify the binary's integrity absent a code-signing certificate check. The installer's unsigned status [T1036] removes the one verification step that might have surfaced the masquerade.

Environment Checks Before Payload Drop: Static Evidence of Sandbox Awareness

Before the SmartInstaller PE proceeds to its payload execution stage, it performs a set of environmental checks that are consistent with sandbox and virtual-machine evasion [T1497.002, T1622]. Four static tags on the file document these checks: detect-debug-environment indicates the binary tests for the presence of a debugger attached to its process; direct-cpu-clock-access suggests it reads the CPU's timestamp counter (RDTSC instruction) directly, a technique used to detect the timing anomalies that sandbox environments introduce when emulating or monitoring execution; checks-network-adapters indicates enumeration of network interface hardware, a common VM-detection heuristic since many sandbox environments present virtualised or absent network adapters; and checks-usb-bus reflects enumeration of USB bus devices, another hardware-presence check that physical machines pass and many sandboxes fail.

It is important to be precise about the evidentiary basis here: these are static analysis tags derived from the binary's code paths, not dynamic observations from a sandbox detonation. The inference that these checks function as sandbox gates before payload execution is analytically sound given the established behaviour of adware and downware families that use identical techniques, but it is an inference from static indicators rather than an observed execution trace. The precise gate logic — whether the installer aborts entirely, sleeps, or degrades its payload on detection — cannot be confirmed from static indicators alone.

What the static tags do establish is that the binary's authors invested effort in analysis-environment awareness. This is not a characteristic of a hastily assembled adware bundle; it reflects a deliberate design choice to suppress automated detonation verdicts. The practical effect is visible in the detection landscape: 28 of 77 engines return no detection, and four return type-unsupported results. Engines that rely primarily on dynamic analysis or cloud-based detonation for verdict generation are more likely to miss a sample that actively probes its execution environment before proceeding.

The detection gap is worth examining in more detail. Forty-three engines flag the file, drawing from a broad cross-section of the security vendor ecosystem — the flagging list includes engines from multiple continents and product tiers. Twenty engines return no detection. Among the non-detecting engines are several with strong market presence in the regions and sectors this campaign targets. The detection split reflects a sample that sits at the boundary between adware (a category some engines treat as lower-priority than outright malware) and a trojanised installer with espionage-relevant capabilities — a classification ambiguity that the operators may be deliberately exploiting.

The b1.org Infrastructure: Jurisdictional Layers and a Certificate That Mirrors the Lure

The campaign's sole characterised network node is IP address 83.222.126.244, and its infrastructure profile is more analytically interesting than a clean detection score of 0/91 would suggest. The IP sits within the RIPE-registered block 83.222.124.0/22, administratively assigned to True Records Inc. — a British Virgin Islands entity — and operated by DigitalOne AG, headquartered at Bahnhofstrasse 27, 6301 Zug, Switzerland, under ASN 47328. The IP itself geolocates to Russia. That three-layer jurisdictional structure — BVI registration, Swiss operator, Russian geolocation — is a hosting arrangement that distributes administrative and legal accountability across multiple jurisdictions, complicating both takedown requests and attribution analysis. The RIPE record for the block was created on 30 December 2009 and last modified on 2 July 2016, indicating long-standing infrastructure rather than a recently provisioned node.

The operationally significant signal is the TLS certificate currently serving on this IP. As of 14 June 2026, the IP presents a Let's Encrypt certificate with serial number 669d71e7d6f2a97a81467da0cbd32685111, issued by the Let's Encrypt intermediate authority with CN YE2. The certificate was issued on 3 June 2026 and expires on 1 September 2026 — an 89-day validity span that is the standard Let's Encrypt automated-renewal window, not a custom commercial certificate lifetime. Its subject CN is b1.org, and its Subject Alternative Names extend to blog.b1.org, online.b1.org, and search.b1.org.

The brand alignment between that certificate and the installer payload is the most analytically striking element of this campaign. The file's internal product string is "B1 Free Archiver Installer." The IP's TLS certificate covers b1.org — the domain of the real B1 Free Archiver product — and three subdomains whose names (online, search) are consistent with a software distribution or search-and-download service. The certificate was issued in June 2026, more than twelve years after the installer's first VirusTotal submission in November 2013. That temporal gap is the core puzzle: either the legitimate b1.org infrastructure has been operating continuously on this IP across that period, or the IP is hosting infrastructure that impersonates or proxies the b1.org brand to serve as a distribution or update channel for the adware campaign.

CTX Team assesses this brand alignment as an inference-level link between the file IOC and the IP, not a confirmed C2 relationship. No direct network telemetry, sandbox C2 callback, or DNS resolution record connects the installer to this IP. The IP should be treated as a candidate distribution or update node — the subdomains online.b1.org and search.b1.org are particularly consistent with a software-serving function — rather than a confirmed command-and-control endpoint. The inferred C2 or update channel would operate over HTTPS [T1071], with the legitimate-looking b1.org certificate providing cover for the traffic.

The 0/91 detection score on the IP is a notable triage risk. An automated pipeline relying on IP reputation alone would pass this node as clean, despite the brand-aligned certificate and its association with a campaign carrying a 43/77 file detection consensus. ASN 47328 appears on no other IP, meaning there is no corroborating cluster of IPs on the same autonomous system to reinforce the infrastructure fingerprint — the picture is built entirely from this single node.

The Glasses Family and the Three Uncharacterised Payloads

The campaign is attributed to the glasses malware family in the threat-feed metadata, but that attribution cannot be grounded in the available file evidence. The sole characterised file IOC — SHA256 7e3e3ac84476fa7cb405e24f85adcd1fc8fefb7475105618618baa67038466d1 — is classified as adware.catalina/downware, not as a glasses implant. The three remaining file IOCs — cc2ee4171f352388ad6a763eeb0ef007fa4033b7b932453a6b3f1b610b7b860e, 93b2373fde28a4521d2e3e3e791e7940c24f7bd3048632c02f3fe749928248a2, and 6955a97a40164637f08a5be45026a2d78173a78959c9353b95e85daf13283614 — remain uncharacterised. They are SHA256 values and nothing more — no file type, size, detection ratio, tags, submission dates, or popular names have been retrieved — and without detonation the full payload scope stays unresolved.

This is the primary analytical gap. The characterised installer is flagged as adware.catalina/downware and functions as a trojanised freeware bundle — a commodity-tier initial access mechanism. The MITRE technique set attributed to this campaign, however, extends well beyond adware capability: T1055 (process injection), T1056.001 (keylogging), T1012 (registry query), T1070.004 (file deletion), T1485 (data destruction), T1486 (data encryption for impact), T1559.001 (inter-process communication via Component Object Model), and T1562.001 (disabling or modifying security tools) collectively describe a post-compromise capability set consistent with a full-featured espionage implant, not a freeware bundler. The glasses family is the most likely carrier of those capabilities, but without metadata on the three uncharacterised SHA256s, that inference cannot be confirmed.

The overlay and runtime-modules tags on the characterised installer suggest a dropper model: payload data appended beyond the PE's declared sections, loaded at runtime rather than written to disk as a discrete file. This is architecturally consistent with a first-stage installer that unpacks or downloads a second-stage component — potentially the glasses implant — after passing its environmental checks. The ET INFO Packed Executable Download IDS rule hit reinforces this reading: the network session in which the installer was observed also involved a packed executable transfer, which could represent either the installer itself being fetched or a secondary download initiated by the installer after execution.

The file is analytically isolated in another sense: it shares no imphash, signer, or threat label with any peer sample. The imphash c805426348b451efda8350f2d205186b appears only on this sample, meaning the common-builder signal that cross-file imphash clustering provides — five files sharing an imphash indicating a shared compilation environment — is absent here. Each of the three uncharacterised SHA256s may have its own imphash and build provenance, but without VT metadata those axes cannot be computed. No cross-cert-serial, shared A-record, or NS-record linkages connect the indicators, leaving the infrastructure picture limited to the single IP node.

The gap between the adware-tier initial installer and the espionage-grade technique set is the central analytical tension. Two readings are plausible. The first is that the SmartInstaller PE is a deliberate low-sophistication first stage, chosen precisely because adware-classified binaries attract less aggressive automated response than files labelled as APT implants — a strategy of blending into commodity malware noise to reduce the probability of infrastructure takedown or victim notification. The second is that the characterised sample is a relatively minor component of a more complex toolchain, and the glasses implant carried by the three uncharacterised SHA256s is where the actual collection capability resides. Both readings are consistent with the available evidence; neither can be confirmed without full detonation of the uncharacterised samples.

Comment Crew Attribution and the South Asia Education Targeting

CTX Team attributes this campaign to Comment Crew — also tracked under the aliases APT1, Byzantine Candor, Byzantine Hades, Shanghai Group, Comment Panda, GIF89a, BrownFox, and Comment Group — with a medium-confidence designation and espionage as the stated motivation. The attribution is not independently corroborated by public reporting, and the medium confidence rating reflects that limitation. The actor prose budget for this article is deliberately constrained: actor identity is supporting context, not the analytical spine.

The targeting profile — education and research institutions in South Asia — is consistent with intelligence-collection objectives focused on academic, scientific, or policy-relevant intellectual property. South Asia's research institutions encompass a range of strategically relevant domains: defence-adjacent engineering programs, agricultural and biotechnology research with dual-use implications, and policy institutes whose output informs government decision-making. A freeware-lure delivery vector is well-suited to this target population: researchers and students are frequent consumers of utility software, and institutional software procurement processes may leave gaps that individuals fill by downloading freeware from public sites.

The actor's alignment is assessed as state-aligned with China, at medium confidence, based on the threat-feed attribution. Public reporting has long associated the Comment Crew designation with a prolific espionage operation, but the specific claims from that body of reporting are not reproduced here as fact. What the evidence does establish is the targeting vector and the operational longevity: a campaign whose payload first appeared in November 2013 and whose infrastructure carries a certificate issued in June 2026 represents more than twelve years of continuous or intermittent operation against a consistent target profile.

What the Longevity Signal and the Evidence Gap Mean for the Threat Landscape

The most significant analytical observation from this campaign is not the tradecraft — content-type spoofing and freeware masquerading are well-documented techniques — but the operational timeline. The SmartInstaller PE was first submitted to VirusTotal on 12 November 2013. The Let's Encrypt certificate on 83.222.126.244 was issued on 3 June 2026 and remains valid through 1 September 2026. That is a span of more than twelve years between the payload's first observed appearance and the most recent certificate renewal on the associated infrastructure. Even accounting for the inference-level confidence of the IP-to-file linkage, the persistence of brand-aligned infrastructure on ASN 47328 across that period is a notable operational longevity signal.

Let's Encrypt certificates are renewed automatically by ACME clients, typically on a 60–90 day cycle. The 89-day validity of the current certificate is standard for automated Let's Encrypt rotation. This means the infrastructure operator is running an active certificate management process on this IP — not a dormant server with an expired certificate, but a live system with current automated renewal. The subdomains covered by the certificate (blog.b1.org, online.b1.org, search.b1.org) are consistent with a functioning web presence, not a parked domain. Whether that presence serves the adware campaign's distribution function, provides a cover story for C2 traffic, or represents the legitimate b1.org operator sharing infrastructure with a malicious actor cannot be determined from current evidence — but the operational implication is the same: the network node is active.

The broader significance of the adware-to-espionage gap is worth examining as a trend signal. The use of commodity adware delivery mechanisms — freeware masquerading, HTTP content-type spoofing, bundled installers — as the initial access layer for espionage-grade toolchains is a tradecraft choice that exploits the categorical separation in most security operations between adware response (low priority, often deferred) and APT response (high priority, immediate escalation). A detection that comes back as adware.catalina/downware may be triaged differently than one that returns a glasses or APT1 label, even if the underlying binary is the first stage of a multi-stage collection operation. The overlay and runtime-modules PE tags on this installer suggest the binary is designed to be more than it appears — but the adware classification provides cover for that additional capability in automated triage pipelines.

The three uncharacterised SHA256s represent the primary unresolved question. If those files are glasses implant samples, their full detonation would either confirm the adware-to-implant dropper hypothesis — establishing a documented first-stage-to-second-stage handoff — or reveal a more complex multi-stage toolchain with additional persistence, lateral movement, or exfiltration components. Until those samples are characterised, the MITRE techniques attributed to this campaign that go beyond the installer's documented behaviour — including T1055 process injection, T1056.001 keylogging, T1485 data destruction, and T1486 encryption for impact — remain inferred from actor attribution rather than grounded in direct evidence from the available file set. That gap is not a reason to dismiss the attribution, but it is a reason to treat the full capability scope as provisional until the remaining payloads are analysed.

What this campaign ultimately illustrates is the analytical risk of treating adware-classified binaries as categorically separate from espionage tooling. The installer in this cluster is, by detection consensus, adware. It is also, by the evidence of its environmental checks, its overlay structure, and its infrastructure's brand alignment with a live and actively renewed web presence, something that warrants the same analytical scrutiny applied to any unsigned PE delivered over HTTP with a spoofed content type to targets in a region of active intelligence interest. The operators' apparent willingness to maintain this infrastructure across more than a decade — and to keep its TLS certificate current into the third quarter of 2026 — suggests a campaign that has not concluded, only quieted.