Based on the OTX pulse data, the BabaDeda loader family represents an evolving malware framework discovered in April 2026 that utilizes advanced social engineering techniques known as ClickFix. The malware demonstrates significant enhancements in stealth capabilities, evasion techniques, and payload flexibility. The attack chain begins with social engineering exploits (ClickFix) that trick users into clicking seemingly legitimate elements, leading to the deployment of malicious payloads concealed within installer packages. The objective appears to be establishing a foothold in enterprise networks for secondary payload deployment, potentially including information theft, ransomware delivery, or establishing persistent backdoor access.
Threat Actor / Malware Profile
BabaDeda Loader
-
Distribution Method: The BabaDeda loader is distributed through social engineering exploits known as ClickFix, which manipulate users into interacting with malicious content. The payloads are concealed within seemingly legitimate installer packages to evade initial detection.
-
Payload Behavior: The loader exhibits significant advancements in stealth and evasion, allowing it to remain undetected on compromised systems while facilitating the deployment of secondary payloads. It shows enhanced flexibility in payload delivery.
-
C2 Communication: Based on the IOCs, the malware communicates with command and control servers via HTTP on non-standard ports (e.g., 3038, 9000, 6600), likely using specific parameters or paths for payload retrieval and status updates.
-
Persistence Mechanism: While not explicitly detailed in the pulse, the loader likely establishes persistence through standard mechanisms such as registry modifications, scheduled tasks, or Windows services.
-
Anti-Analysis Techniques: The malware employs advanced evasion techniques to avoid detection and analysis, likely including code obfuscation, anti-debugging measures, and behavior monitoring for sandbox environments.
IOC Analysis
The pulse includes 31 total indicators of various types:
- File Hash (MD5): b2e581c85432bd4df6a59a00cbda1cb3 - this is the hash of a malicious sample
- Domains: cirealci.com, humansbad2026.com - likely C2 or distribution domains
- URLs: Multiple URLs with IP addresses and specific paths, indicating potential payload download locations or C2 endpoints
SOC teams should operationalize these indicators by:
- Blocking the domains and URLs at network perimeter devices
- Configuring EDR solutions to alert on processes attempting to connect to these domains/URLs
- Scanning endpoints for files matching the provided hash
- Implementing network monitoring rules to detect connections to the specified IP addresses
Network analysis tools like Wireshark can decode the network communications, while file analysis tools like Cuckoo Sandbox or IDA Pro can analyze the malicious samples.
Detection Engineering
---
title: BabaDeda Loader C2 Connection Detection
id: 2a3b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
description: Detects connections to known BabaDeda loader C2 domains and IPs
status: stable
author: Security Arsenal
references:
- https://otx.alienvault.com/pulse/6721b3c8d4e1f/
date: 2026/07/27
tags:
- attack.command_and_control
- attack.t1071.001
logsource:
category: network_connection
product: windows
detection:
selection_domains:
DestinationHostname|contains:
- 'cirealci.com'
- 'humansbad2026.com'
selection_ips:
DestinationIp:
- '91.92.243.161'
- '89.124.81.216'
- '94.26.83.190'
- '95.163.152.190'
selection_ports:
DestinationPort:
- 3038
- 9000
- 6600
selection_url_params:
DestinationUrl|contains:
- 'wbinjget'
- 'DataRescueCommunity'
- 'track.php?d='
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
---
title: BabaDeda Loader File Hash Detection
id: 3b4c5d6e-7f8a-9b0c-1d2e-3f4a5b6c7d8e
description: Detects known BabaDeda loader files by MD5 hash
status: stable
author: Security Arsenal
references:
- https://otx.alienvault.com/pulse/6721b3c8d4e1f/
date: 2026/07/27
tags:
- attack.initial_access
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Hashes|contains:
- 'MD5=b2e581c85432bd4df6a59a00cbda1cb3'
condition: selection
falsepositives:
- None
level: critical
---
title: ClickFix Social Engineering Pattern Detection
id: 4c5d6e7f-8a9b-0c1d-2e3f-4a5b6c7d8e9f
description: Detects potential ClickFix social engineering activity based on URL patterns and file downloads
status: stable
author: Security Arsenal
references:
- https://otx.alienvault.com/pulse/6721b3c8d4e1f/
date: 2026/07/27
tags:
- attack.initial_access
- attack.t1190
- attack.t1566.001
logsource:
category: network_connection
product: windows
detection:
selection_url_patterns:
DestinationUrl|contains:
- '/track.php?d='
- '/linguist.zip'
- 'wbinjget?q='
- 'DataRescueCommunity'
selection_file_download:
InitiatingProcessCommandLine|contains:
- 'download'
- 'curl'
- 'wget'
- 'Invoke-WebRequest'
condition: 1 of selection_*
falsepositives:
- Legitimate downloads with similar patterns
level: medium
kql
// Hunt for connections to BabaDeda C2 domains
DeviceNetworkEvents
| where RemoteUrl in ("cirealci.com", "humansbad2026.com")
or RemoteIP in ("91.92.243.161", "89.124.81.216", "94.26.83.190", "95.163.152.190")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| order by Timestamp desc
// Hunt for files with known BabaDeda hash
DeviceFileEvents
| where MD5 == "b2e581c85432bd4df6a59a00cbda1cb3"
| project Timestamp, DeviceName, FileName, FolderPath, SHA1, SHA256, InitiatingProcessAccountName
| order by Timestamp desc
// Hunt for ClickFix URL patterns
DeviceNetworkEvents
| where RemoteUrl has_any ("/track.php?d=", "/linguist.zip", "wbinjget?q=", "DataRescueCommunity")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by Timestamp desc
powershell
# BabaDeda Loader IOC Hunt Script
# Run as Administrator
# Check for files with known BabaDeda hash
Write-Host "Searching for files with known BabaDeda hash..."
$knownHash = "b2e581c85432bd4df6a59a00cbda1cb3"
$drives = Get-PSDrive -PSProvider FileSystem
foreach ($drive in $drives) {
Write-Host "Scanning drive $($drive.Root)"
Get-ChildItem -Path $drive.Root -Recurse -ErrorAction SilentlyContinue |
Get-FileHash -Algorithm MD5 -ErrorAction SilentlyContinue |
Where-Object { $_.Hash -eq $knownHash } |
Select-Object Path, Hash | Format-Table -AutoSize
}
# Check for network connections to known C2 domains
Write-Host "Checking for connections to known BabaDeda C2 domains..."
$c2Domains = @("cirealci.com", "humansbad2026.com")
$c2IPs = @("91.92.243.161", "89.124.81.216", "94.26.83.190", "95.163.152.190")
$processes = Get-Process | Where-Object { $_.MainModule.FileName -ne $null }
foreach ($process in $processes) {
$connections = Get-NetTCPConnection -OwningProcess $process.Id -ErrorAction SilentlyContinue |
Where-Object { $_.RemoteAddress -ne "0.0.0.0" -and $_.RemoteAddress -ne "127.0.0.1" -and $_.RemoteAddress -notlike "::*" }
if ($connections) {
foreach ($conn in $connections) {
try {
$remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress)
foreach ($domain in $c2Domains) {
if ($remoteHost.HostName -like "*$domain*" -or $remoteHost.Aliases -like "*$domain*") {
Write-Host "Found connection to C2 domain: $($remoteHost.HostName) from process $($process.ProcessName) (PID: $($process.Id))"
}
}
} catch {
# Failed to resolve hostname
}
foreach ($ip in $c2IPs) {
if ($conn.RemoteAddress -eq $ip) {
Write-Host "Found connection to C2 IP: $($conn.RemoteAddress) on port $($conn.RemotePort) from process $($process.ProcessName) (PID: $($process.Id))"
}
}
}
}
}
# Check for suspicious registry keys
Write-Host "Checking for suspicious persistence mechanisms..."
$suspiciousPaths = @(
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($path in $suspiciousPaths) {
if (Test-Path $path) {
$items = Get-Item -Path $path -ErrorAction SilentlyContinue
if ($items) {
foreach ($property in $items.Property) {
$value = $items.GetValue($property)
if ($value -match "(cirealci.com|humansbad2026.com|91.92.243.161|89.124.81.216|94.26.83.190|95.163.152.190)") {
Write-Host "Suspicious registry entry found at $path\$property with value: $value"
}
}
}
}
}
Write-Host "Scan complete."
Response Priorities
Immediate (0-24 hours)
- Block all listed domains (cirealci.com, humansbad2026.com) and IPs at network perimeter devices
- Search endpoints for files matching the provided MD5 hash (b2e581c85432bd4df6a59a00cbda1cb3)
- Review network logs for connections to the provided indicators
- Deploy the detection rules provided above to security monitoring platforms
- Conduct targeted hunting for potential infections using the provided scripts
24 Hours
- Conduct identity verification for potentially compromised accounts if credential-stealing malware is suspected
- Analyze systems that have connected to these indicators for secondary payload delivery
- Review endpoint logs for evidence of installer execution around the time of connections
- Check for evidence of lateral movement from any identified compromised systems
1 Week
- Review and update security awareness training to address ClickFix social engineering tactics
- Implement additional controls to detect and prevent similar loader-based attacks
- Conduct a comprehensive review of software installation policies and procedures
- Strengthen application control policies to restrict unauthorized software installation
- Review and enhance network monitoring for non-standard port usage
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.