Loading malware…
BadPaw is a Windows .NET malware family used as a staged loader in a targeted cyberespionage campaign against Ukrainian entities. It is implemented as a .NET Framework 4.6 program and masquerades as a benign Windows Forms regular-expression utility, presenting a functional decoy interface while withholding its malicious behavior unless launched through the intended infection chain with specific parameters. In observed operations, BadPaw was delivered through phishing emails that led victims to a ZIP archive containing a disguised HTA stage, followed by VBScript and steganographic extraction of the loader from an image. The malware established persistence earlier in the chain via a scheduled task and then used command-and-control communications to retrieve and deploy a second-stage implant, MeowMeow, a backdoor used for follow-on access and remote tasking.
BadPaw incorporates substantial anti-analysis and defense-evasion measures. Reported protections include .NET Reactor obfuscation, anti-debugging, anti-tamper integrity checks, sandbox and virtual-environment detection, timing-based checks, runtime reconstruction of API names, and benign fallback behavior when executed outside the expected workflow. It fingerprints infected hosts through multiple WMI queries and derives a victim identifier from hardware and system attributes. Analysis also indicates support for encrypted communications and a process-injection workflow using dynamically reconstructed Windows APIs, suggesting preparation for in-memory execution of additional payloads.
The malware has been linked to a Russian state-aligned campaign targeting Ukraine, with public reporting assessing low to moderate confidence in attribution to APT28. Its role in the intrusion set is primarily to bridge initial access and post-compromise tooling by contacting attacker infrastructure, downloading additional components, and launching the MeowMeow backdoor. The campaign’s use of Ukrainian-themed lures, layered staging, parameter-gated execution, and anti-research controls is consistent with a deliberate espionage-oriented tradecraft model rather than commodity malware distribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
At the time of analysis, the file is recognized as malicious by only nine antivirus engines. We have named this malware “BadPaw”. Its primary objective is to establish communication with a Command and Control (C2) server to download additional malicious components.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
BadPaw builds a comprehensive victim profile through seven WMI queries via the SOS class
To ensure persistence on the infected system, a scheduled task is created to execute the VBS file.
An additional layer of defense employed by BadPaw is the use of .NET Reactor, a commercial protection and obfuscation tool for .NET assemblies.
LibHelperDemo[.]vbs accesses the accompanying image file to extract hidden data, a technique known as steganography.
Layer 5: API String Splitting -- Win32 API names are split across the .NET #US heap ... These are reassembled at runtime via Marshal.GetDelegateForFunctionPointer. Static string scanners see nothing.
The retrieved ZIP archive contains a file with an .html extension; however, this is a masquerade. Technical analysis reveals the file is actually an HTA (HTML Application).
Process Injection Chain ... OpenProcess obtains a handle to the target, VirtualAlloc reserves memory, WriteProcessMemory writes the payload, and VirtualProtect flips the page to executable.
The PE compilation timestamp is falsified to 2039, an anti-forensics measure.
Technical analysis reveals the file is actually an HTA (HTML Application). Upon execution, the HTA file drops and opens a decoy document...
Layer 4: Sandbox Detection -- The Sand class implements IsSandBox() for environment fingerprinting, CheckSleep() for timing-based detection ... and a Windows EventLog reader that checks for sandbox-indicator events. System uptime analysis rounds it out -- fresh VMs have short uptimes.
By querying this value, the malware calculates the "age" of the operating system. If the system was installed less than ten days prior to execution, the malware terminates.
Defender Reconnaissance Before any malicious activity, BadPaw queries the registry for the state of Windows Defender: HKLM\SOFTWARE\Microsoft\AMSI ... HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\PassiveMode ...
Before phoning home, BadPaw builds a comprehensive victim profile through seven WMI queries ... MAC address, Disk serial number, Motherboard serial, BIOS information, Computer system details, OS identity string, Process ID.
Layer 4: Sandbox Detection -- The Sand class implements IsSandBox() for environment fingerprinting, CheckSleep() for timing-based detection ... and a Windows EventLog reader that checks for sandbox-indicator events. System uptime analysis rounds it out -- fresh VMs have short uptimes.
By querying this value, the malware calculates the "age" of the operating system. If the system was installed less than ten days prior to execution, the malware terminates.
“Upon establishing command-and-control (C2) communication, the loader deploys MeowMeow…”
The Task-Based C2 ... GetTaskRequest() -- poll the C2 for pending commands ... Transport is HTTPS with custom User-Agent headers
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of a newly exposed malware duo used in a Russian campaign targeting Ukraine.
A .NET Framework 4.6 trojan downloader that masquerades as a legitimate regex testing utility while using layered anti-analysis protections including obfuscation, anti-debugging, anti-tamper checks, sandbox detection, API string splitting, WMI-based host fingerprinting, Defender reconnaissance, structured HTTPS C2 communications, and a process injection chain to deploy an embedded payload.
A newly reported malware family used in a phishing campaign targeting Ukrainian organizations.
One of a newly reported malware pair used in a Russian campaign targeting Ukraine.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.