Security researchers have discovered CNCMachineRMS, a 1.14 MB x64 remote access trojan (RAT) that is part of a BabaDeda-based infection chain. The final decoy reads shellcode from model.dat, placing it inside a large buffer padded with random data, marking the region as executable, and triggering through EnumTimeFormatsEx. The required file, HelperStandardizationApplication.bin, has high entropy and resembles encrypted data; however, researchers discovered it actually contains an obfuscated serialized property tree with a script and the embedded CNCMachineRMS payload.
CNCMachineRMS eliminates valuable static indicators by omitting import tables, employing FNV hashing to pinpoint Windows API functions, and storing strings only during runtime.
The loader chain from the ClickFix lure to the final implant (Source: levelblue) bypasses dynamic tool detection due to the absence of readable API names and normal imports in the executable. The decoded functionality includes an interactive shell, file management, screen capture, local-account creation, seven persistence options, and 20 commands capable of downloading and executing additional payloads. It gathers domain, SID, elevation status, BIOS, motherboard identifiers, installed antivirus details, and other host information before operators select their next action.
