Loading malware…
BabaDeda is a Windows shellcode-based staging component used in a ClickFix intrusion chain that ultimately deploys the CNCMachineRMS remote access trojan. It is executed through a DLL-based loader sequence that abuses the legitimately signed IBM SPSS WinWrap Basic IDE binary to invoke malicious scripting through COM, then uses decoy DLLs and the Windows EnumTimeFormatsEx API to run shellcode while blending into normal system activity. On its own, BabaDeda performs little functionality and depends on a separate configuration container that holds an obfuscated configuration tree, operator script logic, and the embedded CNCMachineRMS payload.
BabaDeda functions primarily as a loader or stager rather than the final implant. Its role is to bridge initial user execution from a ClickFix social-engineering lure into in-memory execution of the next-stage malware. The associated CNCMachineRMS payload provides interactive shell access, file management, screenshot capture, host profiling, local account creation, persistence, and retrieval and execution of additional payloads, indicating that BabaDeda is part of a broader hands-on-keyboard post-compromise framework. The overall intrusion set emphasizes defense evasion through trusted binary abuse, staged execution, memory-resident shellcode, obfuscated configuration data, and masquerading persistence. Observed targeting is consistent with Windows environments, and the campaign has been associated with social-engineering lures aimed at inducing victims to run attacker-supplied commands.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
After the ClickFix lure, attackers launch IBM SPSS WinWrap Basic IDE and steer its scripting function toward malicious files.
It passes the shellcode through EnumTimeFormatsEx, a harmless Windows date-formatting interface, so Windows itself calls the code.
From there, a run of four decoy DLLs loads through ordinary import resolution, with no suspicious API calls and no odd LoadLibrary to flag.
The infection begins with a ClickFix lure, a tactic that persuades someone to run a command presented as a routine solution.
It has no imports. Every string is built on the stack at runtime instead of sitting in the binary. Its config and its command and control (C2) traffic travel in the same custom binary container... That file, HelperStandardizationApplication.bin, looks like an encrypted blob at 8 bits of entropy per byte. It is not encrypted. It is a configuration tree under two layers of obfuscation...
The last decoy fills a buffer with random data, places shellcode inside it, and makes the memory executable.
In this case, WinWrapIDE.exe is clean and legitimately signed. The attackers exploit its ability to activate a scripting engine through COM, directing it to a dropped DLL.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A shellcode-based loader stage in the infection chain. It relies on a separate configuration file and is used to load the embedded CNCMachineRMS payload, making partial samples appear less suspicious during quick automated analysis.
A memory-only shellcode stage in the loader chain that depends on an external configuration file and is used to unpack/load the embedded CNCMachineRMS payload.
A shellcode stage in the infection chain that relies on an external configuration file and embedded script to ultimately load the CNCMachineRMS payload. It appears to function as a loader rather than the final implant.
An intermediate shellcode stage used in the loader chain. By itself it is minimally functional and depends on a separate config file containing an obfuscated configuration tree and the embedded CNCMachineRMS payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.