[{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/tags/babadeda/","section":"Tags","summary":"","title":"Babadeda","type":"tags"},{"content":" Executive Summary # Following malware-traffic-analysys.net blogs about SmartApeSG ClickFix linked to unidentified RAT, i investigated the infection chain in depth and found overlaps with the BabaDeda malware. The unidentified RAT appears to be the CNCMachineRMS RAT as dubbed by LevelBlue, delivered by the BabaDeda Loader analyzed by Morphisec. I noticed that the loader and the RAT share the same characteristics: the API hashing algorithm, the encrypted stack strings mechanism,a custom Scripting Engine and a distinctive storage configuration tree, which would suggest the same malware toolkit.\nBabaDeda Loader # Stripped of the specific file names each campaign used, the schema adopted is the same: a ClickFix lure 🎣 tricks a user into launching a legitimately signed executable, which sideloads trojanized DLL\u0026rsquo;s that in turns retrive and run the xored BabaDeda loader. Morphisec inspects the loader in details, here some points:\n🧰 Legitimate host abuse — a signed application is used to launch the malicious code from a trusted process 🔗 DLL sideloading chains — multiple DLLs, some spoofed with fake version resources to impersonate real libraries, force-loaded via IAT redirection or static imports rather than suspicious runtime LoadLibrary calls. 📦 Shellcode staged as data, not code — the actual shellcode never appears as a standalone executable; it\u0026rsquo;s held inside a data file and only deccrypted at runtime. ↩️ Indirect callback execution — instead of calling the payload directly, the loader passes its address as a callback to a benign Win32 enumeration API (e.g. EnumTimeFormatsEx, EnumSystemCodePagesW). Windows itself invokes the payload from inside a system DLL, so no attacker-authored code ever calls it. 🕵️ Environment fingerprinting and evasion — computer name, username, system paths, tick count, sandbox/VM checks, geolocale checks (exit on specific countries), keyboard layout checks, security-product enumeration. 🗂️ External config-driven staging — a custom \u0026ldquo;storage\u0026rdquo; file format, tells the loader what to persist, what to run, and where the real payload lives. 🔄 Self-reasserting persistence — Run keys and scheduled tasks are recreated on a timed loop, not just set once, so partial remediation doesn\u0026rsquo;t stick. 🎭 Disguised persistence values — the registry value name / scheduled task name mimics the legitimate host application and is pulled from config, not hardcoded, so it can vary per campaign. In the campaign reported by malware-traffic-analysis.net on the 2026/07/31 legit @eset SysInspector.exe was abused to sideload a trojanized log2..dll, which in turns retrived obfuscated BabaDeda loader inside Preview.Strings.dat, decrypted it and ran it via EnumTimeFormatsEx from the forged dll SMInfrastructure.dll. BabaDeda Loader, than parsed additional contents from Tracks_Interface.bak (custom storage configuration tree), one of which is the final payload RAT.\nBabaDeda RAT # LevelBlue profiles final RAT payload , dubbed CNCMachineRMS, in depth. According with their analysis, here a recap of the main capabilities:\n🖥️ Interactive shell — remote command execution. 📁 File manager — browse, read, transfer files. 📸 Screen capture — including an automatic screenshot on first contact with C2. 👤 Local account backdoor — creates local accounts and adds them to privileged groups. 🔄 Seven persistence vectors — registry Run keys (HKCU/HKLM), scheduled tasks, startup shortcuts. ⚙️ Twenty typed loader/task opcodes — remote-driven deployment of MSI, EXE, DLL, PowerShell, and BAT payloads, including download-then-execute variants and zipped-archive delivery. 🗄️ Custom Storage config tree similar format embedded in the binary. 💾 Local file doubles as a full state database. 🌐 DNS over HTTPS for C2 resolution. Domain lookups go through dns.google, cloudflare-dns.com, and dns.quad9.net instead of the local resolver — so internal DNS logs never see the C2 domain being queried. WinHTTP fallback if the raw TCP gate fails. 🧬 Custom scripting engine drives everything: Persistence, gate setup, VM checks. 🧾 Deep host/environment profiling — AD identity (domain, SID, elevation), hardware and firmware serials (motherboard/BIOS — survives a reinstall), installed AV via WMI, open ports with owning PID, installed applications, running processes. This is the extracted configuration of the CNCMachineRMS, for the mentioned case.\n{ \u0026#34;campaign\u0026#34;: \u0026#34;first\u0026#34;, \u0026#34;lsdb_save_path\u0026#34;: \u0026#34;{localappdata}\\\\\\\\UTProject\\\\\\\\utc.bin\u0026#34;, \u0026#34;lsdb_save_delay_seconds\u0026#34;: 200, \u0026#34;is_marketing_notify\u0026#34;: false, \u0026#34;is_tosend_firstlaunch_screenshot\u0026#34;: true, \u0026#34;enable_acs_onstart\u0026#34;: true, \u0026#34;gate_connect_period_seconds\u0026#34;: 600, \u0026#34;gate_connected_duration_seconds\u0026#34;: 90, \u0026#34;gate_failed_reconnect_delay_seconds\u0026#34;: 60, \u0026#34;gate_keep_alive_duration_seconds\u0026#34;: 90, \u0026#34;gate_list\u0026#34;: [ [ \u0026#34;notepadreleased.com\u0026#34;, \u0026#34;443\u0026#34; ], [ \u0026#34;89.124.79.98\u0026#34;, \u0026#34;443\u0026#34; ] ], \u0026#34;is_vmcheck\u0026#34;: true, \u0026#34;vmdetect_sleep_seconds\u0026#34;: 660 } One of the post-operation activities observed during similar campaigns is the deployment of additional payloads, such as commodity stealers, RATs, RMM software and scripts. In this case, CNCMachineRMS was used to distribute a VBScript designed to steal cryptocurrency and wallet information.\nlegit Eset sysinpector.exe abused by BabaDeda malware The stolen data were uploaded to a Wallet Reports panel hosted at hxxp://87.199.205[.]109/panel/\nwallet report panel from vbs script The Common Characteristics # BabaDeda Loader and CNCMachineRMS have at least 4 shared characteristics: API hashing, encrypted stack strings, a peculiar storage config tree, and a custom scripting engine. These similarities lead me to believe that they belong to the same BabaDeda Malware family. For this reason i would suggest using the alternative name BabaDeda RAT for the RAT.\n🔢 API hashing # APIs are resolved at runtime via hashing with modified FNV-1aalgorithm:\napi hashing via modified FNV-1a algorithm 🔐 Stack strings # Strings are constructed on the stack at the point of use via a custom LCG+XOR scheme.\nstack strings decryption with LCG+XOR scheme 🗄️ The storage configuration tree # A custom container file format with structural details:\nCharacteristic Values Disguise extensions .bak .db .bin .dat .raw .pak Entry header size 0x58 bytes Entry table offset 0x78 Obfuscation Arithmetic formulas gated by a build-specific key ⚙️ A custom scripting engine # Use of same small task-based domain-specific language, here a part of the extracted code:\ntask autorun_to_registry[active=true,async=true] { loop { delayer::delay_in_seconds(150); autorunToRegistry(); } } task block_execution[active=true,async=false] { int $resid = runtime::resource_get_id(@input); complex $exe_bytes = runtime::resource_get_bytes($resid); previewer::load_re_firmcode($exe_bytes); delayer::delay_infinite(); } Conclusion # Taken individually, either report reads as \u0026ldquo;a BabaDeda campaign.\u0026rdquo; Taken together, the shared API hashing scheme, the shared encrypted stack-string mechanism, the byte-for-byte identical storage container format, and — most tellingly — a shared custom scripting engine interpreting that container the same way, all point to something more specific: BabaDeda Malware pack with Loader + RAT.\nIoCs # file sha256 553003097200721800.zip 24f9e1a7d122d0340251828fde0a0c45f69967c14f4a1b2dfe606772bdb0b275 SysInspector.exe (legit) 548e2a1b4113c16d421df342e4beed5aaa393db29810936788bf2b7f720537a9 log-2..dll 2e2788460a1545482e358e9f72367b7db26d84a1e226a745ab4a3c3a9585ac86 SMInfrastructure.dll c092b9e93712da5e78914a508f8349ec4af77fd92a0f50e6e6ebd5c4997cd6ba Preview.Strings.dat b6bb68193efd14ba21f4e08fceae210789a293707c304cad63a9fcd95c18419d Tracks_Interface.bak 25194b5c4cd07a61ffb958823004bf4a53a4251aba6aff09600887632ea53fd0 babadeda loader 6d5d2279f323e6482aeda8188c2c97aaf3d03d429ac4869efcec8dce5c2587a6 CNCMachineRMS 6d5d2279f323e6482aeda8188c2c97aaf3d03d429ac4869efcec8dce5c2587a6 C2 domain: notepadreleased[.]com C2 IP: 89.124.79[.]98 C2 port: 443 wallet stealer ip: 87.199.205[.]109 sample also shared on malware bazar\naddittional links:\nother sample linked to same c2 malware bazar similar campaign from malware-traffic-analysis hudsonrock analysis on info stealer campaing ","date":"16 August 2026","externalUrl":null,"permalink":"/posts/babadeda-malware-analysis/","section":"Posts","summary":"Following malware-traffic-analysys.net blogs about SmartApeSG ClickFix linked to unidentified RAT, i found overlaps with BabaDeda malware. The unidentified final playload appears to be the CNCMachineRMS RAT described by levelblue delivered by BabaDeda loader analyzed by Morphisec. Loader and RAT share same characteristic: API hashing algorithm, encrypted stack strings mechanism, peculiar  storage config tree, custom Scripting Engine suggesting same malware toolkit","title":"BabaDeda Malware: Loader and RAT pack","type":"posts"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/tags/clickfix/","section":"Tags","summary":"","title":"Clickfix","type":"tags"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/tags/loader/","section":"Tags","summary":"","title":"Loader","type":"tags"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/categories/malware-analysis/","section":"Categories","summary":"","title":"Malware Analysis","type":"categories"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/","section":"marsomx","summary":"","title":"marsomx","type":"page"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/posts/","section":"Posts","summary":"","title":"Posts","type":"posts"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/tags/rat/","section":"Tags","summary":"","title":"RAT","type":"tags"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/tags/smartapesg/","section":"Tags","summary":"","title":"SmartApeSG","type":"tags"},{"content":"","date":"16 August 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"10 January 2026","externalUrl":null,"permalink":"/tags/plugx/","section":"Tags","summary":"","title":"Plugx","type":"tags"},{"content":" Executive summary # Another PlugX malware campaign was identified by @malwarehunterteam on 9 January 2026. The attack initially exploits a critical Windows LNK vulnerability (CVE-2025-9491), followed by multi-stage payload delivery via DLL sideloading techniques using legitimate Steam application files. The campaign has employed geopolitical themes (the US-Adriatic Charter Partnership Commission) as a social engineering lure in order to allegedly target European entities. The delivery and triggering method of PlugX, along with other additional obfuscation layer of its configuration, suggest a possible variant of the malware.\nIdentification # On the 9th of January 26, malwarehunterteam shared a post on about a zip file dubbed \u0026ldquo;Post-Meeting_Report_US-Adriatic_Charter_Partnership_Commission.zip\u0026rdquo;\nX post by @malwarehunterteam post The zip file, which contains a lnk file with the same name, was uploaded to Malware Bazar by @simca83 and attributed to Mustang Panda.\nAttack Chain Overview # I started looking at the .lnk file and observed this chain.\nStep 1: └─→ LNK file └─→ PowerShell script execution └─→ Downloads nested ZIP archive └─→ Extracts TAR archive to %APPDATA% This was already reported in a previous campaign, where TA exploited CVE-2025-9491 to deploy PlugX. The extracted files resulted in:\nstep 2: DLL Sideloading └─→ Legitimate steam_monitor.exe (signed binary) └─→ Malicious crashhandler.dll (sideloaded DLL) └─→ crashlog.dat (encrypted payload + shellcode + decoy PDF) The shellcode embedded in the data file was responsible for decrypting the XOR-encrypted PlugX payload and activating the malware via RtlRegisterWait native api.\ncrashlog.dat # crashlog.dat present a custom format which includes shellcode, encrypted PE and the PDF (decoy) as per the following layout\nLayout: ┌────────────────────────────────────────────────────────┐ │ 0x00000 - 0x95205 │ ENCRYPTED PE + Initial Stub │ │ │ (XORed with 0x7a) │ ├────────────────────────────────────────────────────────┤ │ 0x95206 - 0x9524E │ DECRYPTION STUB (plaintext!) │ │ │ ~75 bytes of x86 code │ ├────────────────────────────────────────────────────────┤ │ 0x9524F - 0xB0C22 │ APPENDED PDF (plaintext) │ │ │ Decoy/stealth data │ └────────────────────────────────────────────────────────┘ crashhandler.dll # crashhandler.dll is the malicious dll sideloaded by legit steam exe. The function CreateInterface loads dat file and prepares its execution. In details it resolves API via hashing function, allocates memory space, decrypts xored dat name, retrives and loads dat file in memory, change allocated memory protection, prepare shellcode execution via RegisterWait callback\napi resolution the function sub_100013E2 implements a simple API hashing algorithm identified by HashDB as add1501_shl5.\nrtlregisterwait native api The shellcode is executed via RtlRegisterWait and SetEvent API\nPlugx # Looking at the plugx payload, i noticed it employs multiple XOR-based string encryption algorithms to obfuscate API names and configuration and other values. The following image shows the code where CreateThread API name is decrypted, resolved via sub_100038DE and than used to start core main thread (sub_10001290)\nplugx string CreateThread decryption As already documented, plugx store its encrypted RC4 configuration into .data section. In this sample, i noticed another obfuscation layer consisting by a positional XOR.\nrc4 and postional-xor for configuration decryption Basically for each string block from the RC4 data decryption process, an initial accumulator is computed as follow a3_init = i3 + count where i3 is the length of the RC4 key and count is the value read from the block\u0026rsquo;s QWORD header. Than for each byte i in the encrypted payload:\nplaintext[i] = encrypted_payload[i] ^ ((count + a3_init) \u0026amp; 0xFF) a3_init = a3_init + count The keystream is therefore a linear sequence stepping by count each byte, with an initial offset determined jointly by the string\u0026rsquo;s own length and the global seed.\nextracted configuration\nLure filename Post-Meeting_Report_US-Adriatic_Charter_Partnership_Commission.pdf Campaign tag HOyvWAfnD Persist path \u0026ldquo;%public%\\Steam\u0026rdquo; Staging path \u0026ldquo;%temp%\u0026rdquo; C2 domain majicbus.org:443 IoCs # file sha256 27122025_0228_Post-Meeting_Report_US-Adriatic_Charter_Partnership_Commission.lnk.zip b1606ca49aa15eadb039f33d438697973b203693d0003e467e1f33b36d10a530 Post-Meeting_Report_US-Adriatic_Charter_Partnership_Commission.lnk 87929c8f53341a5e413950d33c7946c64e1d4b2eba6d1a8b2d08ef56f7065052 steam_monitor.exe (legit) 8c0051a83b3611ff2b669b670aa005633f3d9e844454a112b31d2a4bc944a234 crashhandler.dll 843b22df66f87a587be77145da163f9615fe8164a5ea17f9e33562ff43894fbf crashlog.dat 6788365386ccd34d1db681c61ef07ef4d2faea5672571b77a76dc48f327afaa9 C2 domain:majicbus.org C2 port: 443 sample shared on malware bazar\n","date":"10 January 2026","externalUrl":null,"permalink":"/posts/another_plugx_steam_campaign/","section":"Posts","summary":"","title":"Plux Steam Campaign targets European entities","type":"posts"},{"content":" I am an ICT engineer with a huge passion for the infosec world. I currently work at Leonardo as a Malware Analyst for the Incident Response team. I revamped this space to share notes and thoughts collected during malware analysis and other cybersec activities in my spare time. I hope my content will be useful to the community in some way. #sharingiscaring\nDon\u0026rsquo;t forget to follow me on X. ","date":"5 January 2026","externalUrl":null,"permalink":"/about/","section":"marsomx","summary":"","title":"About","type":"page"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"}]