New malware loader – BabbleLoader

BabbleLoader is a newly identified malware loader designed for delivering information-stealing payloads such as WhiteSnake and Meduza. It demonstrates sophisticated evasion techniques that challenge both traditional antivirus solutions and modern AI-driven detection systems. Read this Cybersecurity Threat Advisory to learn how to protect against this cutting-edge malware loader. 

BabbleLoader is a modular loader that uses a variety of techniques to evade detection. It loads shellcode that paves the way for decrypted code, a Donut loader, which unpacks and executes the stealer malware. The techniques to avoid detection, include:

• Packing the code to make it difficult to analyze
• Encrypting the code to make it difficult to understand
• Using anti-debugging techniques to prevent analysis
• Using in-memory execution to avoid detection by traditional antivirus solutions

BabbleLoader uses junk codes and metamorphic transformations to avoid detection. It dynamically resolves functions at runtime, impeding static and behavioral analysis. Its structure varies per sample, making signature-based identification difficult. The malware first loads encrypted shellcode, which then unpacks further components like the Donut loader, responsible for deploying the final payload (WhiteSnake or Meduza). This layered approach enhances the protection of malicious payloads, designed to bypass antivirus and sandbox environments to deliver stealers into memory. 

It targets English and Russian speaking users who are looking for cracked software to download, as well as business professionals looking for accounting and HR software. It can lead users and companies exposed to data theft, financial loss, compromised systems, and potential ransomware follow-ups. 

 LBT Technology Group recommends the following actions to mitigate the risks associated with this stealthy malware loader:

• Update all systems to the latest version to patch any vulnerabilities that may be exploited regularly.
• Employ robust endpoint security solutions with advanced threat detection capabilities, such as LBT's XDR Endpoint Security, to protect systems against potential threats.
• Educate users about the risk of downloading software from unofficial sources.
• Block known malicious domains and IPs linked to BabbleLoader campaigns and use filtering and logging to detect anomalous communications.

 For more in-depth information about the recommendations, please visit the following links:

• https://thehackernews.com/2024/11/new-stealthy-babbleloader-malware.html
• https://intezer.com/blog/research/babble-babble-babble-babble-babble-babble-babbleloader/

If you have any questions, please contact LBT's Sales Engineer.