Loading malware…
BADAUDIO is a highly obfuscated C++ first-stage downloader associated with the PRC-nexus threat actor APT24 and used in a multi-year cyberespionage campaign. Reporting in the provided content ties the malware to operations active from at least November 2022 through 2025, with targeting focused especially on Windows systems and victim organizations in Taiwan, and in some reporting the United States. The broader campaign used multiple delivery vectors, including watering-hole compromises of more than 20 legitimate websites, JavaScript supply-chain compromise of a Taiwan-based digital marketing firm affecting more than 1,000 domains, and targeted spear-phishing. Phishing lures included messages impersonating an animal rescue organization, and separate campaigns abused Google Drive and OneDrive to distribute encrypted archives containing BADAUDIO. The malware has also been described as using DLL search order hijacking as part of execution or persistence.
Functionally, BADAUDIO performs host reconnaissance, collecting system-identifying information including the current Windows username, hostname, and architecture. It obfuscates strings using stack strings and SSE-based XOR deobfuscation, and it encrypts collected data with a hardcoded AES-256 key using CTR mode. The recovered AES-256 key reported in the content is b31b6db8f6f905fc9560f237c7af38515bd2a80d50e079bd1e297a1a9e94c8fe. For command-and-control communications, BADAUDIO uses the WinINet API to issue an HTTP GET request to the path /v3.1/current_user/details and embeds encrypted host data in HTTP Cookie header values including __etag and FMPIS. Decoded strings observed in analysis included header names such as Cookie, User-Agent, Accept, Accept-Language, and Cache-Control, as well as API names including InternetOpenA, InternetReadFile, and HttpQueryInfoA. The malware is capable of downloading, decrypting, and executing an AES-encrypted payload from a hard-coded C2 server, and reporting in the content states that second-stage payloads included Cobalt Strike Beacon. At the time of one analysis, the referenced C2 domain returned NXDOMAIN. The content also notes use of workers.dev infrastructure to blend traffic with legitimate Cloudflare-hosted services and rotate disposable subdomains.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A recent Google Cloud report shed additional light on APT24’s activities; however, it provided only a brief overview of badAudio, a distinctive downloader associated with the group. As a sample of this malware became publicly available, we conducted an in-depth reverse engineering analysis to better understand its functionality, cryptographic design, and operational role within APT24’s intrusion chain.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
"APT24 targeted over 20 public websites with illicit JavaScript code that displayed a bogus software update pop-up, tricking Windows users into downloading BadAudio"
"more than 1,000 domains compromised through a supply chain attack against a Taiwanese digital marketing firm beginning July 2024"
"APT24 concurrently conducted highly targeted social engineering campaigns. Lures, such as an email purporting to be from an animal rescue organization, leveraged social engineering to elicit user interaction and drive direct malware downloads from attacker-controlled domains."
BadAudio collects host-identifying information prior to network communication... retrieves the current Windows username via GetUserNameExW... queries the system hostname via kernel32!GetComputerNameW... The collected host information is then concatenated with an architecture identifier
BadAudio builds and sends an HTTP request using the WinINet API... specifying the HTTP verb 'GET' and the object path '/v3.1/current_user/details'... Finally, the request is transmitted via wininet!HttpSendRequestA.
encrypting (then Base64-encoding) host/configuration data before embedding it in an HTTP request header
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A first-stage downloader/loader associated with APT24 that collects host-identifying information, encrypts it with hardcoded AES-256 in CTR mode, Base64-encodes it, and embeds it in an HTTP Cookie header before sending a WinINet GET request to C2 infrastructure. It also uses XOR/SSE-based string obfuscation and stack strings to hinder static analysis.
Previously undocumented malware used for persistent remote access in a multi-year espionage campaign attributed to APT24.
An espionage tool or campaign used by APT24, leveraging watering holes, JavaScript supply-chain compromise, and phishing to target government and strategic sectors.
BADAUDIO is a highly obfuscated C++ first-stage downloader used by APT24 for espionage. It establishes persistent remote access, conducts reconnaissance, and delivers AES-encrypted payloads (including Cobalt Strike) while evading detection through advanced techniques such as DLL search order hijacking and in-memory payload execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.