#BabaDeda - Twitter Hashtag

10 days ago

[1/2] One of the post-operation activities observed during #BabaDeda campaigns is the deployment of additional payloads: commodity stealers, RATs, RMM software and scripts. In this case https://t.co/ihdcZWoY00, it led to #StealC infection(https://t.co/g3ebOqwtDJ) #rat config:

marsomx_'s tweet photo. [1/2]
One of the post-operation activities observed during #BabaDeda campaigns is the deployment of additional payloads: commodity stealers, RATs, RMM software and scripts. In this case https://t.co/ihdcZWoY00, it led to #StealC infection(https://t.co/g3ebOqwtDJ) #rat config: https://t.co/9ge7nMSltT

1

7

3

2

367

Simplicio Sam L. @marsomx_

12 days ago

days ago @LevelBlueCyber published about #CNCMachineRMS an undocumented #rat delivered by #BabaDeda loader identified by @morphisec. Similarities found in samples lead me to believe that they belong to the same #BabaDeda #malware family. some notes👇 https://t.co/KVP8FhT4CJ

1

7

2

3

542

Mich

@dubstard

about 4 years ago

@OPLabsPBC @Eranetcom1 @eurobyte_ru @ActorExpose @bunnymaid @CryptoScamDB @Vonnie610 @ETHGlobal @kelvinfichter @kevinjho_ @liamihorne @optimismFND @protolambda @sniko_ @OptimismGov ⚠Fairly low @virustotal detection 3/65! cc @JRoosen @malwrhunterteam @osipov_ar @hatching_io Triage - https://t.co/fU5gHOEyL5 SHA256 🔎dc799c06ac66ee96cff51dfbe485375f9b3371c4646495d5f916988f1a2217ce #babadeda #RemcosRat #бабадеда

dubstard's tweet photo. @OPLabsPBC @Eranetcom1 @eurobyte_ru @ActorExpose @bunnymaid @CryptoScamDB @Vonnie610 @ETHGlobal @kelvinfichter @kevinjho_ @liamihorne @optimismFND @protolambda @sniko_ @OptimismGov ⚠Fairly low @virustotal detection 3/65!

cc @JRoosen @malwrhunterteam @osipov_ar

@hatching_io Triage - https://t.co/fU5gHOEyL5

SHA256 🔎dc799c06ac66ee96cff51dfbe485375f9b3371c4646495d5f916988f1a2217ce

#babadeda #RemcosRat #бабадеда https://t.co/tON2F5KQ1J

1

3

1

0

Hido Cohen @0xhido

over 4 years ago

Another #crypto scam by NFT-001 using #BABADEDA Crypter to deliver #Remcos #Discord DM -> Decoy -> Github -> BABADEDA -> Remcos DLL side-loading on AdobeIPCBroker.exe Decoy: hector[.]fund Decoy IP: 185.212.130[.]102 Fake Installer: HECTOR-dApp-v2.6.2r.exe C2: 145.239.253[.]176

0xhido's tweet photo. Another #crypto scam by NFT-001 using #BABADEDA Crypter to deliver #Remcos

#Discord DM -> Decoy -> Github -> BABADEDA -> Remcos

DLL side-loading on AdobeIPCBroker.exe

Decoy: hector[.]fund
Decoy IP: 185.212.130[.]102
Fake Installer: HECTOR-dApp-v2.6.2r.exe
C2: 145.239.253[.]176 https://t.co/HxVoA6PnVz

2

5

3

0

Arnold Osipov @osipov_ar

over 4 years ago

#NFT scam continues. Again, delivering #Remcos via #Babadeda Same #discord fake DM. romedao[.]fund satoshiswap[.]online IP - 185.212.130[.]56 name: RomeDao-dApp-v2.1.9-release.exe SatoshiSwap-App-v2.1.9.exe C2: 193.56.29[.]242:4783 @SatoshiSwapHQ @CryptoScamDB

osipov_ar's tweet photo. #NFT scam continues. Again, delivering #Remcos via #Babadeda

Same #discord fake DM.

romedao[.]fund
satoshiswap[.]online
IP - 185.212.130[.]56

name:
RomeDao-dApp-v2.1.9-release.exe
SatoshiSwap-App-v2.1.9.exe

C2: 193.56.29[.]242:4783

@SatoshiSwapHQ @CryptoScamDB https://t.co/SUZvCrhf37

1

16

12

1

0

Arnold Osipov @osipov_ar

over 4 years ago

Wondering when these are going to get some hits. #remcos delivered via #Babadeda. ~2 months, 5 scans, 0 VT hits. C2 - 193.56.29[.]242 nice detection though @hatching_io https://t.co/dn2ptayRIF #FUD

osipov_ar's tweet photo. Wondering when these are going to get some hits. #remcos delivered via #Babadeda.

~2 months, 5 scans, 0 VT hits.

C2 - 193.56.29[.]242

nice detection though @hatching_io https://t.co/dn2ptayRIF
#FUD https://t.co/WEQPUzRYxf

2

18

11

2

0

Michele Campa @s1ckb017

over 4 years ago

#BabaDeda #LorecCPL #OutSteel #Ukraine #Lorec53 https://t.co/AQjHrNtWx2 under track ip C2: 45.12.5.]62 contacted from a second implant babadeda to download new implant flexspace.]app 185.244.41.]109 used since October

s1ckb017's tweet photo. #BabaDeda #LorecCPL #OutSteel #Ukraine #Lorec53
https://t.co/AQjHrNtWx2
under track ip C2: 45.12.5.]62 contacted from a second implant babadeda to download new implant
flexspace.]app
185.244.41.]109 used since October https://t.co/nhHnWflU3C

1

22

7

6

0

Arnold Osipov @osipov_ar

over 4 years ago

We (@0xhido + myself) just released a follow-up blog to our previous #BABADEDA Crypter. This time, we covered the threat actor operations since Nov 2020 (Still active). 💸 Some samples are totally #FUD after several scans More details + IOCs: https://t.co/g3EsFqaPLN #NFT #scam

osipov_ar's tweet photo. We (@0xhido + myself) just released a follow-up blog to our previous #BABADEDA Crypter. This time, we covered the threat actor operations since Nov 2020 (Still active). 💸

Some samples are totally #FUD after several scans

More details + IOCs: https://t.co/g3EsFqaPLN

#NFT #scam https://t.co/trV6mRdu06

2

19

9

3

0

Hido Cohen @0xhido

over 4 years ago

Another #BABADEDA Crypter sample with low detection rate, this time delivering #Phobos #ransomware https://t.co/pK5vTFE6bD

0

2

0

1

0

Hido Cohen @0xhido

over 4 years ago

#BABADEDA Crypter is now supported by @hatching_io 💪

Hatching @hatching_io

over 4 years ago

Time for a new Triage Thursday post! We've got #Emotet E5 detections, updates for #Redline and #Flubot, and new support for #Babadeda and #OnlyLogger We've also fixed FPs with #mimikatz and #Redline, and expanded the data in static reports via the API. https://t.co/MdILH82UP9

hatching_io's tweet photo. Time for a new Triage Thursday post!

We've got #Emotet E5 detections, updates for #Redline and #Flubot, and new support for #Babadeda and #OnlyLogger

We've also fixed FPs with #mimikatz and #Redline, and expanded the data in static reports via the API.

https://t.co/MdILH82UP9 https://t.co/9tsyD6sNiM

2

42

17

3

0

2

0

Hatching @hatching_io

over 4 years ago

Time for a new Triage Thursday post! We've got #Emotet E5 detections, updates for #Redline and #Flubot, and new support for #Babadeda and #OnlyLogger We've also fixed FPs with #mimikatz and #Redline, and expanded the data in static reports via the API. https://t.co/MdILH82UP9

2

42

17

3

0

Morphisec

@morphisec

over 4 years ago

Morphisec recently uncovered #Babadeda, a discord #malware campaign that's targeting #NFT communities such as @opensea + @BoredApeYC. @BleepinComputer expands on the story here -> https://t.co/Q8TbvxkGhL

0

2

1

0

SOC Prime @SOC_Prime

over 4 years ago

New #Babadeda crypter is leveraged to bypass security protections, covertly deliver a variety of #infostealers and #RATs. Detect associated malicious activity with a set of #Sigma rules released by our keen Threat Bounty developers. https://t.co/8YHKcRyxjB #DFIR #threathunting

0

5

3

1

0

Arnold Osipov @osipov_ar

almost 5 years ago

#Babadeda Crypter -> #Lockbit 2.0 Ransomware🔒 md5: ba41516a1f5be626dc95b08f597217fe

0

5

1

0

BeInCrypto Brasil @BeInCrypto_BR

almost 5 years ago

🐁O #malware #Babadeda tem sido distribuído em canais do #Discord com foco em temas do mercado #cripto, especialmente novas #criptomoedas ou projetos #NFT. Em alguns casos, os #hackers enviam mensagens privadas para os membros. #BeInCrypto 👨🏻‍💻Proteja-se: https://t.co/B9hq2mrUSx