Loading malware…
BabaDeda is a Windows crypter and staged malware loader used to conceal and execute additional malicious payloads. It decrypts shellcode and malicious libraries, sometimes through multiple stages, and can carry encrypted components in XML or PDF files. Payloads associated with BabaDeda include the OutSteel document stealer, Remcos remote access trojan, and CNCMachineRMS remote administration implant. Its role is payload concealment and execution; the remote-control and data-theft capabilities of those payloads are distinct from the loader itself.
BabaDeda employs obfuscation, hashed API resolution, and runtime string reconstruction to hinder analysis. In a ClickFix-delivered infection chain, attackers abuse the legitimately signed IBM SPSS WinWrap Basic IDE through COM redirection and DLL sideloading. A sequence of decoy libraries places shellcode in a noise-filled memory buffer and invokes it through the Windows EnumTimeFormatsEx callback mechanism. The BabaDeda stage then consumes an external obfuscated configuration tree containing a task script and the embedded final payload. Its task script can repeatedly restore persistence through a registry autorun entry and a scheduled task. Other associated infection chains use startup-folder shortcuts, XOR concealment, packing, self-deletion, and Discord-hosted archives.
BabaDeda has appeared in ClickFix campaigns and spear-phishing delivery chains, including activity associated with Ember Bear, also tracked as UAC-0056, UNC2589, and Nodaria. That actor has used BabaDeda to deliver OutSteel. BabaDeda has also been associated with threats targeting cryptocurrency, NFT, and decentralized-finance communities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The BabaDeda crypter acts as an installer and executes shellcode stored encrypted in a file, such as xml or pdf.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence is re-asserted on a loop every 150 seconds for the registry and every 875 seconds for the scheduled task... The same string is used as the scheduled task name.
After the ClickFix lure, attackers launch IBM SPSS WinWrap Basic IDE and steer its scripting function toward malicious files.
It passes the shellcode through EnumTimeFormatsEx, a harmless Windows date-formatting interface, so Windows itself calls the code.
From there, a run of four decoy DLLs loads through ordinary import resolution, with no suspicious API calls and no odd LoadLibrary to flag.
The attackers exploit its ability to activate a scripting engine through COM, directing it to a dropped DLL.
Persistence is re-asserted on a loop every 150 seconds for the registry and every 875 seconds for the scheduled task... The same string is used as the scheduled task name.
There are no cleartext APIs or strings anywhere in the shellcode. APIs are resolved at runtime from hashes, and strings are built on the stack by a custom cipher.
The last decoy fills a buffer with random data, places shellcode inside it, and makes the memory executable.
In this case, WinWrapIDE.exe is clean and legitimately signed. The attackers exploit its ability to activate a scripting engine through COM, directing it to a dropped DLL.
Before any of that, the decoy library fingerprints the environment: computer name, username, system and Windows and temp and current directory paths, tick count, system and local time... alongside sandbox and analysis evasion checks.
Every module opens directly from the application directory, with no failed search path probe first.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a malware loader delivered through ClickFix in the broader trend of ransomware deployment. No family-specific technical analysis is provided.
A shellcode-based loader stage in the infection chain. It relies on a separate configuration file and is used to load the embedded CNCMachineRMS payload, making partial samples appear less suspicious during quick automated analysis.
A memory-only shellcode stage in the loader chain that depends on an external configuration file and is used to unpack/load the embedded CNCMachineRMS payload.
A shellcode stage in the infection chain that relies on an external configuration file and embedded script to ultimately load the CNCMachineRMS payload. It appears to function as a loader rather than the final implant.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.