Patchwork

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.^[1]

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as "Net Monitor."^[1] They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.^[4]

Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.^[4]

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.^[3]

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.^[1][3]

Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.^[1][3]

Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.^[6]

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.^[3]

Patchwork used Base64 to encode C2 traffic.^[1]

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.^[3]

Patchwork bypassed User Access Control (UAC).^[1]

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.^[2][3][4][6]

Patchwork removed certain files and replaced them so they could not be retrieved.^[3]

Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.^[8]

Patchwork has obtained and used open-source tools such as QuasarRAT.^[4]

Patchwork scanned the "Program Files" directories for a directory with the string "Total Security" (the installation path of the "360 Total Security" antivirus tool).^[1]

A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.^[1]

Patchwork leveraged the DDE protocol to deliver their malware.^[3]

Patchwork attempted to use RDP to move laterally.^[1]

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.^[1][8][3][4]

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.^[3]

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.^[6]