MalwareUsed by 1 actorExploits 4 CVEs

BADFLICK

BADFLICK is a Windows backdoor associated with the China-linked espionage group APT40, also tracked as Leviathan and GreenCrash. It has been observed as one of the group’s frequently used backdoors in intrusions targeting government, academic, research, maritime, and other strategic sectors aligned with APT40 collection priorities. BADFLICK has been delivered through spearphishing campaigns, including malicious Microsoft Word attachments that rely on user execution.

Functionally, BADFLICK supports remote access and post-compromise collection. Reported capabilities include generating a reverse shell, downloading files from command-and-control infrastructure, uploading files from victim systems, and searching the infected host for files of interest. It also performs host and network reconnaissance by collecting details such as the victim computer name, processor and memory information, and IP address information. BADFLICK has also been documented decoding shellcode with a custom rotating XOR routine and delaying outbound communication for several minutes, behavior consistent with defense evasion and staged execution.

Within APT40 operations, BADFLICK has been used alongside other malware and tooling to help establish footholds and support broader intrusion activity. Its observed tradecraft is consistent with espionage-oriented backdoors used for interactive access, victim profiling, file collection, and follow-on tasking on compromised Windows hosts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2017-8759.NET Framework WSDL Parser Remote Code Execution

PHOTO, BADFLICK, and CHINA CHOPPER are among the most frequently observed backdoors used by APT40.

via fireeyefireeye.com

CVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability

PHOTO, BADFLICK, and CHINA CHOPPER are among the most frequently observed backdoors used by APT40.

via fireeyefireeye.com

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code Execution

PHOTO, BADFLICK, and CHINA CHOPPER are among the most frequently observed backdoors used by APT40.

via fireeyefireeye.com

CVE-2017-11882Microsoft Office Equation Editor Remote Code Execution Vulnerability

PHOTO, BADFLICK, and CHINA CHOPPER are among the most frequently observed backdoors used by APT40.

via fireeyefireeye.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Leviathan

APT40 has used a combination of tool frameworks and malware to establish persistence, escalate privileges, map, and move laterally on victim networks. ... BADFLICK/Greencrash

via cisa certus-cert.cisa.gov

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1190Exploit Public-Facing ApplicationEvidence1

"APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation..."

T1566.001Spearphishing AttachmentEvidence6

delivered via spearphishing emails... attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails... has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

Execution

2 techniques

T1204User ExecutionEvidence2

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

T1204.002Malicious FileEvidence3

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

Persistence

1 technique

T1505.003Web ShellEvidence1

"APT40 relies heavily on web shells for an initial foothold... provide continued access... re-infect... and facilitate lateral movement."

Stealth

2 techniques

T1140Deobfuscate/Decode Files or InformationEvidence6

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1497.003Time Based ChecksEvidence1

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

"...credential harvesting tools to escalate privileges and dump password hashes... ProcDump... Windows Credential Editor (WCE)..."

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1082System Information DiscoveryEvidence8

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1497.003Time Based ChecksEvidence1

Collection

2 techniques

T1005Data from Local SystemEvidence2

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

T1560.002Archive via LibraryEvidence1

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

"Common TCP ports 80 and 443 are used to blend in with routine network traffic."

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

ACTIVITY FEED

Recent activity

21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

21 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Captures victim IP address details.

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Enterprise New Software: ... BADFLICK

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that decodes shellcode with a custom rotating XOR cipher.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Malware capable of uploading files from victim machines.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BADFLICK