Downloader Malware Written in JPHP Interpreter

**Executive summary:** ASEC discovered and analyzed a JPHP-based downloader distributed in a ZIP with an embedded JRE that executes PHP-compiled bytecode (.phb). The malware disables Windows Defender monitoring, contacts an initial C2, and uses Telegram short URLs to fetch a dynamic additional C2; it is observed to download secondary data-stealing malware (e.g., Strrat, Danabot). The report includes MD5 hashes and IP addresses as IOCs and highlights the use of obscure tooling (JPHP) to evade detection.