Security researchers have uncovered CNCMachineRMS, a 1.14 MB x64 remote access trojan (RAT) delivered at the end of a BabaDeda-based infection chain.
The malware avoids common static-analysis signals by shipping without an import table, resolving Windows APIs from hashes at runtime, and creating its strings only when needed.
The attack begins with a ClickFix lure and eventually launches a legitimate, signed IBM SPSS WinWrap Basic IDE executable, WinWrapIDE.exe.
Although the signed program is clean, attackers abuse its COM scripting capability to load a malicious DLL. Four decoy DLLs then load through normal Windows import resolution, helping the chain avoid suspicious LoadLibrary activity.
The final decoy reads shellcode from model.dat, places it inside a large buffer padded with random data, marks the region executable, and triggers it through EnumTimeFormatsEx.
This benign Windows date-formatting API calls the supplied callback, allowing the shellcode to run without a direct malicious function call in the attacker’s code.
CNCMachineRMS Hides APIs Hashing
That shellcode is a BabaDeda stage. On its own, it may appear harmless in a sandbox: it displays a “Not Found Storage” message and waits because it requires an external configuration file.
The required file, HelperStandardizationApplication.bin, has high entropy and resembles encrypted data, but researchers found it is actually an obfuscated serialized property tree containing a script and the embedded CNCMachineRMS payload.
CNCMachineRMS removes useful static clues. It has no import table, uses an FNV-style hashing method to locate Windows API functions, and builds strings on the stack only at runtime.
Dynamic API resolution commonly hides malicious capabilities from static tools because readable API names and normal imports are absent from the executable.attack.
The implant is designed for hands-on access rather than immediate credential theft.
Its decoded functionality includes an interactive shell, file management, screen capture, local-account creation, seven persistence options, and 20 commands that can download and execute additional payloads.
It collects domain, SID, elevation status, BIOS and motherboard identifiers, installed antivirus details, and other host information before operators choose their next action.
The RAT takes a screenshot during initial contact and beacons every 600 seconds.
It uses notepadreleased[.]com and 85[.]158.110.78 over TCP/443, retries after 60 seconds, and can resolve domains through DNS over HTTPS providers including Google, Cloudflare, and Quad9. This may reduce visibility in internal DNS logs.
A custom scripting language controls behavior through namespaces such as delayer::, runtime::, autoruns::, and communicator::, levelblue said.
Indicators of Compromise
| Type | Indicator | Details |
|---|---|---|
| C2 domain | notepadreleased[.]com | TCP/443 |
| C2 IP | 85[.]158.110[.]78 | TCP/443 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 delivered at the end of a BabaDeda-based){kind=link}