MalwareUsed by 1 actor

Ke3chang

Ke3chang is malware associated with the Ke3chang threat activity cluster. Observed capabilities in the provided content include collecting the system language ID of a compromised machine; using batch scripts to install persistence mechanisms; performing service discovery with net start; conducting account discovery with commands such as net localgroup administrators and net group "REDACTED" /domain; performing local network connection discovery with netstat; gathering local network configuration with ipconfig; and enumerating running processes with tasklist. The content also states that Ke3chang transferred compressed and encrypted RAR files containing exfiltrated data through an established backdoor command-and-control channel. High-confidence targeting information, infection vector details, industries, and specific indicators of compromise are not provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Ke3chang

Ke3chang has used implants to collect the system language ID of a compromised machine.

via mitre attackattack.mitre.org

MITRE ATT&CK

Techniques & procedures

2 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1140Deobfuscate/Decode Files or InformationEvidence1

"...macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload." / "...involved the use of Base64 obfuscated scripts and commands." / "...deobfuscated Base64-encoded commands..."

Discovery

1 technique

T1082System Information DiscoveryEvidence1

"4H RAT sends an OS version identifier in its beacons"; "admin@338 actors used ... ver ... systeminfo"; "Bundlore will enumerate the macOS version ... using /usr/bin/sw_vers -productVersion"; "DarkTortilla ... querying ... WMI objects"; "Turla ... discover operating system configuration details using the systeminfo and set commands"

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

mitre attackNews

Jan 25, 2026

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Backdoor that uses tasklist for process discovery.

mitre attackNews

Jan 25, 2026

System Network Connections Discovery, Technique T1049 - Enterprise | MITRE ATT&CK®

Malware/tooling performing local network connection discovery via netstat.

mitre attackNews

Jan 25, 2026

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®

Exfiltrates data as compressed/encrypted RAR archives over an established backdoor C2 channel.

mitre attackNews

Jan 25, 2026

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor that performs local network configuration discovery via ipconfig.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping2

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Ke3chang