BabaDeda Malware: Loader and RAT pack

Executive Summary

#

Following malware-traffic-analysys.net blogs about SmartApeSG ClickFix linked to unidentified RAT, i investigated the infection chain in depth and found overlaps with the BabaDeda malware. The unidentified RAT appears to be the CNCMachineRMS RAT as dubbed by LevelBlue, delivered by the BabaDeda Loader analyzed by Morphisec. I noticed that the loader and the RAT share the same characteristics: the API hashing algorithm, the encrypted stack strings mechanism,a custom Scripting Engine and a distinctive storage configuration tree, which would suggest the same malware toolkit.

BabaDeda Loader

#

Stripped of the specific file names each campaign used, the schema adopted is the same: a ClickFix lure 🎣 tricks a user into launching a legitimately signed executable, which sideloads trojanized DLL’s that in turns retrive and run the xored BabaDeda loader. Morphisec inspects the loader in details, here some points:

• 🧰 Legitimate host abuse — a signed application is used to launch the malicious code from a trusted process
• 🔗 DLL sideloading chains — multiple DLLs, some spoofed with fake version resources to impersonate real libraries, force-loaded via IAT redirection or static imports rather than suspicious runtime LoadLibrary calls.
• 📦 Shellcode staged as data, not code — the actual shellcode never appears as a standalone executable; it’s held inside a data file and only deccrypted at runtime.
• ↩️ Indirect callback execution — instead of calling the payload directly, the loader passes its address as a callback to a benign Win32 enumeration API (e.g. EnumTimeFormatsEx, EnumSystemCodePagesW). Windows itself invokes the payload from inside a system DLL, so no attacker-authored code ever calls it.
• 🕵️ Environment fingerprinting and evasion — computer name, username, system paths, tick count, sandbox/VM checks, geolocale checks (exit on specific countries), keyboard layout checks, security-product enumeration.
• 🗂️ External config-driven staging — a custom “storage” file format, tells the loader what to persist, what to run, and where the real payload lives.
• 🔄 Self-reasserting persistence — Run keys and scheduled tasks are recreated on a timed loop, not just set once, so partial remediation doesn’t stick.
• 🎭 Disguised persistence values — the registry value name / scheduled task name mimics the legitimate host application and is pulled from config, not hardcoded, so it can vary per campaign.

In the campaign reported by malware-traffic-analysis.net on the 2026/07/31 legit @eset SysInspector.exe was abused to sideload a trojanized log2..dll, which in turns retrived obfuscated BabaDeda loader inside Preview.Strings.dat, decrypted it and ran it via EnumTimeFormatsEx from the forged dll SMInfrastructure.dll. BabaDeda Loader, than parsed additional contents from Tracks_Interface.bak (custom storage configuration tree), one of which is the final payload RAT.

BabaDeda RAT

#

LevelBlue profiles final RAT payload , dubbed CNCMachineRMS, in depth. According with their analysis, here a recap of the main capabilities:

• 🖥️ Interactive shell — remote command execution.
• 📁 File manager — browse, read, transfer files.
• 📸 Screen capture — including an automatic screenshot on first contact with C2.
• 👤 Local account backdoor — creates local accounts and adds them to privileged groups.
• 🔄 Seven persistence vectors — registry Run keys (HKCU/HKLM), scheduled tasks, startup shortcuts.
• ⚙️ Twenty typed loader/task opcodes — remote-driven deployment of MSI, EXE, DLL, PowerShell, and BAT payloads, including download-then-execute variants and zipped-archive delivery.
• 🗄️ Custom Storage config tree similar format embedded in the binary.
• 💾 Local file doubles as a full state database.
• 🌐 DNS over HTTPS for C2 resolution. Domain lookups go through dns.google, cloudflare-dns.com, and dns.quad9.net instead of the local resolver — so internal DNS logs never see the C2 domain being queried. WinHTTP fallback if the raw TCP gate fails.
• 🧬 Custom scripting engine drives everything: Persistence, gate setup, VM checks.
• 🧾 Deep host/environment profiling — AD identity (domain, SID, elevation), hardware and firmware serials (motherboard/BIOS — survives a reinstall), installed AV via WMI, open ports with owning PID, installed applications, running processes.

This is the extracted configuration of the CNCMachineRMS, for the mentioned case.

{
  "campaign": "first",
  "lsdb_save_path": "{localappdata}\\\\UTProject\\\\utc.bin",
  "lsdb_save_delay_seconds": 200,
  "is_marketing_notify": false,
  "is_tosend_firstlaunch_screenshot": true,
  "enable_acs_onstart": true,
  "gate_connect_period_seconds": 600,
  "gate_connected_duration_seconds": 90,
  "gate_failed_reconnect_delay_seconds": 60,
  "gate_keep_alive_duration_seconds": 90,
  "gate_list": [
    [
      "notepadreleased.com",
      "443"
    ],
    [
      "89.124.79.98",
      "443"
    ]
  ],
  "is_vmcheck": true,
  "vmdetect_sleep_seconds": 660
}

One of the post-operation activities observed during similar campaigns is the deployment of additional payloads, such as commodity stealers, RATs, RMM software and scripts. In this case, CNCMachineRMS was used to distribute a VBScript designed to steal cryptocurrency and wallet information.

The stolen data were uploaded to a Wallet Reports panel hosted at hxxp://87.199.205[.]109/panel/

The Common Characteristics

#

BabaDeda Loader and CNCMachineRMS have at least 4 shared characteristics: API hashing, encrypted stack strings, a peculiar storage config tree, and a custom scripting engine. These similarities lead me to believe that they belong to the same BabaDeda Malware family. For this reason i would suggest using the alternative name BabaDeda RAT for the RAT.

🔢 API hashing

#

APIs are resolved at runtime via hashing with modified FNV-1aalgorithm:

🔐 Stack strings

#

Strings are constructed on the stack at the point of use via a custom LCG+XOR scheme.

🗄️ The storage configuration tree

#

A custom container file format with structural details:

⚙️ A custom scripting engine

#

Use of same small task-based domain-specific language, here a part of the extracted code:

task autorun_to_registry[active=true,async=true]
{
    loop
    {
        delayer::delay_in_seconds(150);
        autorunToRegistry();
    }
}

task block_execution[active=true,async=false]
{
    int $resid = runtime::resource_get_id(@input);
    complex $exe_bytes = runtime::resource_get_bytes($resid);
    previewer::load_re_firmcode($exe_bytes);
    delayer::delay_infinite();
}

Conclusion

#

Taken individually, either report reads as “a BabaDeda campaign.” Taken together, the shared API hashing scheme, the shared encrypted stack-string mechanism, the byte-for-byte identical storage container format, and — most tellingly — a shared custom scripting engine interpreting that container the same way, all point to something more specific: BabaDeda Malware pack with Loader + RAT.

IoCs

#

• C2 domain: notepadreleased[.]com
• C2 IP: 89.124.79[.]98
• C2 port: 443
• wallet stealer ip: 87.199.205[.]109

sample also shared on malware bazar

addittional links:

• other sample linked to same c2 malware bazar
• similar campaign from malware-traffic-analysis
• hudsonrock analysis on info stealer campaing