MalwareUsed by 2 actors

BadPatch

BadPatch is a Windows espionage malware family associated with long-running Middle East-focused activity and linked by MITRE to the Gaza Hackers group, also known as Molerats. It functions as a surveillance and collection implant with capabilities centered on victim monitoring, host profiling, document theft, and data exfiltration over HTTP-based command and control.

Observed functionality includes keylogging, screenshot capture, local file collection, and system reconnaissance. BadPatch can capture screenshots in JPG format and exfiltrate them, record keystrokes, collect host metadata such as operating system details, MAC address, and computer name, and search for documents and archives of interest based on extension. Reported targeted file types include common office documents, PDFs, databases, and compressed archives, indicating an emphasis on intelligence collection from user workstations. Collected information may be staged in local log files before exfiltration.

For environmental awareness, BadPatch uses WMI to enumerate installed security products, consistent with security software discovery prior to follow-on actions. For persistence, it establishes a foothold by placing a shortcut to its executable in the Windows Startup folder so it will execute after user logon. Command and control communications have been observed over HTTP, and reporting has also associated the family with command and control of Windows systems over a nonstandard SMTP-related port.

BadPatch has also been linked through shared infrastructure and malware-family overlap to Android espionage activity in the Middle East, including the Welcome Chat operation targeting Arabic-speaking users. That linkage suggests a broader campaign ecosystem operated by the same threat cluster, though BadPatch itself is directly documented here as a Windows malware family.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Gaza Hackers

The Welcome Chat espionage app belongs to the very same Android malware family that we identified at the beginning of 2018. That malware used the same C&C server, pal4u.net, as the espionage campaign targeting the Middle East that was identified in late 2017 by Palo Alto Networks and named BadPatch.

via eset welivesecurity blogwelivesecurity.com

Molerats

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence7

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence7

Stealth

1 technique

T1497.001System ChecksEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Discovery

4 techniques

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1497.001System ChecksEvidence1

T1518.001Security Software DiscoveryEvidence3

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Collection

5 techniques

T1005Data from Local SystemEvidence4

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

T1074Data StagedEvidence2

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1071.003Mail ProtocolsEvidence1

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

26 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that persists by placing a link to its executable in the Startup folder.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Malware that gathers selected file types from local systems and stages them for exfiltration.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware that captures JPG screenshots and exfiltrates them.

mitre attack websiteNews

Jan 1, 2021

Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®

Malware with keylogging capability.

+22 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BadPatch