https://marsomx.github.io/tags/babadeda/Recent content in Babadeda on marsomxHugo -- gohugo.ioens.liberatore@icloud.com (marsomx)s.liberatore@icloud.com (marsomx)© 2026 marsomxSun, 16 Aug 2026 00:00:00 +0000https://marsomx.github.io/posts/babadeda-malware-analysis/Sun, 16 Aug 2026 00:00:00 +0000s.liberatore@icloud.com (marsomx)https://marsomx.github.io/posts/babadeda-malware-analysis/Following malware-traffic-analysys.net blogs about SmartApeSG ClickFix linked to unidentified RAT, i found overlaps with BabaDeda malware. The unidentified final playload appears to be the CNCMachineRMS RAT described by levelblue delivered by BabaDeda loader analyzed by Morphisec. Loader and RAT share same characteristic: API hashing algorithm, encrypted stack strings mechanism, peculiar storage config tree, custom Scripting Engine suggesting same malware toolkit