BADAUDIO
- First seen
- 2023-06-15 00:00:00
- Malware type
- downloader
- Profile updated
- 2026-07-07 14:47:51
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
According to Google, BADAUDIO is a custom first-stage downloader written in C++ that downloads, decrypts, and executes an AES-encrypted payload from a hard-coded command and control (C2) server. The malware collects basic system information, encrypts it using a hard-coded AES key, and sends it as a cookie value with the GET request to fetch the payload. The payload, in one case identified as Cobalt Strike Beacon, is decrypted with the same key and executed in memory.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Badaudio_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Badaudio (report)
- cloud.google.com — Apt24 Pivot To Multi Vector Attacks (report)
- securite360.net — Opsec On A Budget What Badaudio Reveals About Apt24 (report)