Executive Summary
Trojan FIXMAPI Loader is a recently identified malicious stager that leverages legitimate software installation frameworks to infect Windows systems. The attack begins with a trojanized .msi installer created with Advanced Installer, masquerading as a 'Microsoft FIXMAPI V1.0' utility from 'Microsoft Coporation'. This installer drops a suite of files including a primary executable, a DLL for sideloading, a JavaScript component for network activity, and an encrypted configuration file.
Technically, the malware achieves persistence through the CurrentVersion\Run registry key and uses DLL side-loading (T1574.002) to execute its malicious code. It performs host fingerprinting by querying the system registry and WMI to identify default browsers and installed antivirus products. Once the host profile is generated, it exfiltrates the data to a command-and-control (C2) server at dservices.space via HTTP GET requests initiated by a scripting engine.
The use of legitimate installer metadata and deliberate misspellings in the publisher name ('Coporation') indicates a coordinated social engineering effort. This loader serves as a primary reconnaissance tool, likely intended to assess the target environment before deploying more destructive follow-on payloads tailored to the victim's security posture.