FortiGuard Labs came across an interesting tweet from the security researcher @h4ckak about a suspicious file that looks to be a decoy file in an APT campaign. Upon digging deeper and found that this file might be part of a new BadPatch campaign. BadPatch is a tag used for a set of malware that was used in a campaign with a possible link to the Gaza hackers group which was first reported in 2017. This group has been involved in an espionage campaign targeting the Middle East since 2012 based on the compilation timestamp of the first malware discovered. Since then, BadPatch has gone off our radar for almost two years.
This malware is a multi-component python-compiled malware that has the capability to steal and exfiltrate data from targeted victims. We will also be discussing some patterns as proof of this malware’s possible link to BadPatch.
The attack sample uploaded to VirusTotal is an executable file named ???? ??????? ???? ????? .scr (Prime Minister Mohammad Ishtayeh .scr). Although we didn’t find the initial vector from which this file came, we believe that it was distributed as an attachment to spam emails, similar to previous BadPatch attacks.
This executable file is an SFX executable containing two files:
When executed, this file opens the decoy .doc file, which contains text that looks like it was drawn from a news article from Sama News.
It also executes the file d.exe, which only works on 64-bit Windows machine. We believe, though, that a 32-bit version may also exist as other component files. The d.exe file is responsible for downloading three files.