ClearSky Details BadPaw Malware Campaign Targeting Ukraine
Summary
ClearSky researchers describe BadPaw’s delivery and evasion chain, including a disguised HTA, installation-age checks, steganographic persistence and staged C2 downloads that deploy the MeowMeowProgram backdoor.
Key points
- The campaign uses ukr[.]net email addresses and redirects recipients through a tracking pixel before delivering a ZIP archive.
- The ZIP disguises an HTA application as an HTML file; it displays a Ukrainian border-crossing decoy while running malicious processes.
- BadPaw stops if Windows was installed less than ten days earlier, a check intended to evade analysis environments.
- A scheduled task runs a VBS script that extracts hidden executable code from an image using steganography.
- BadPaw uses staged C2 requests to retrieve ASCII-encoded payload data that deploys the MeowMeowProgram backdoor.
- The backdoor provides remote shell and file-system access and includes obfuscation, runtime checks, and detection of forensic tools.
- ClearSky reported Russian-language strings in the code, which may indicate a Russian-speaking developer or a failure to localize the malware.
Article Details
- Attack Vectors
- An email sent from an address hosted on ukr[.]net used a link claiming to host a ZIP archive.
- The link redirected through a tracking pixel before a second redirect delivered the ZIP archive.
- The ZIP contained an HTA application disguised as an HTML file; when executed, it displayed a decoy document while malicious processes ran in the background.
- A scheduled task ran a VBS script that extracted hidden executable code from an image using steganography.
- BadPaw used staged C2 communication to retrieve data from /getcalendar and /eventmanager, then download ASCII-encoded payload data embedded in HTML.
- Defensive Notes
- BadPaw stops execution when the Windows installation is less than ten days old, which may prevent analysis in some sandbox environments.
- The malware monitors for forensic tools including Wireshark, Procmon, Ollydbg, and Fiddler.
- Only nine antivirus engines detected the payload at the time of analysis.
MITRE ATT&CK
T1012 · Query RegistryBadPaw checked a Windows Registry key to determine the system's installation date.T1027 · Obfuscated Files or InformationThe MeowMeowProgram backdoor used .NET Reactor obfuscation.T1027.003 · SteganographyThe VBS script used steganography to extract executable code hidden in an image file.T1036 · MasqueradingThe HTA application was disguised as an HTML file.T1053.005 · Scheduled TaskPersistence was established with a scheduled task that ran a VBS script.T1059.005 · Visual BasicThe scheduled task ran a VBS script that extracted hidden executable code from an image.T1105 · Ingress Tool TransferBadPaw used staged C2 communication to download ASCII-encoded payload data embedded in HTML.T1140 · Deobfuscate/Decode Files or InformationThe downloaded ASCII-encoded data was decoded to deploy the MeowMeowProgram backdoor.T1204.001 · Malicious LinkThe recipient had to click the email link before the redirect chain delivered the ZIP.T1204.002 · Malicious FileThe HTA application in the ZIP had to be executed to start the malicious activity.T1497.001 · System ChecksBadPaw checked the Windows installation date and stopped if the installation was less than ten days old.T1566.002 · Spearphishing LinkThe campaign email used a link claiming to host a ZIP archive.
Threat Actors
Malware
BadPawThe operation, named BadPaw, uses tracking redirects, Windows install-age sandbox checks, steganography-backed persistence, and staged C2 downloads that deploy the MeowMeowProgram backdoor.MeowMeowProgramThe operation, named BadPaw, uses tracking redirects, Windows install-age sandbox checks, steganography-backed persistence, and staged C2 downloads that deploy the MeowMeowProgram backdoor.
Products
Tools
.NET ReactorThe MeowMeow backdoor incorporates four defensive layers, including runtime parameter requirements, .NET Reactor obfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg andFiddlerobfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg and Fiddler.OllyDbgReactor obfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg and Fiddler.Procmon.NET Reactor obfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg and Fiddler.Wiresharkrequirements, .NET Reactor obfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg and Fiddler.