{
  "name": "What Is the BabaDeda Loader? Analysis of a New ClickFix Malware Campaign",
  "slug": "what-is-the-babadeda-loader-analysis-of-a-new-clickfix-malware-campaign",
  "description": "",
  "published": "2026-07-03T13:00:48.283000+00:00",
  "created_at": "2026-07-03T12:54:15.383000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-03T12:54:15.383000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "e907cfbc-dbb0-4b7c-8442-9830fb3ece88",
        "name": "dcd612f1d86ff5c9b43f1a3d0baea16b9c08e4b844bcd82564c720ee1caafe3c"
      },
      {
        "id": "0d28e86b-8fe7-409a-a4e2-fbc74dcc3550",
        "name": "a8a2148d6cf70d06a9c2ecded8b1a21f982cf11ffc9774442209f536a66a8630"
      },
      {
        "id": "87fab4da-36a6-4493-959c-3a63b3de91b9",
        "name": "89.124.81.216"
      },
      {
        "id": "e5517b2e-d5c2-459e-9e03-f20ed64542dd",
        "name": "5c6144b1bb4c195a4dcd7ebac8c427852c7e15cb5b4f5217dda0cfb39a90062a"
      },
      {
        "id": "ebf6f8c3-6335-4366-a9a4-2a277e47677f",
        "name": "http://95.163.152.190/linguist.zip"
      },
      {
        "id": "a225c6b8-0884-4db2-a547-49968568b147",
        "name": "9677584602ae15bdd20d91b9a14768a17c126107739e3853d969ff4e02e10e71"
      },
      {
        "id": "23ddea26-f2f0-4672-b1e6-2d17fec06952",
        "name": "3b4208ec304b60ba9d0ca74838ad7031224a32c36d6e1fa7c616a5ecf5074a5b"
      },
      {
        "id": "0a63c8dc-961e-4391-a311-5f8ee8efe87c",
        "name": "c92950568a2b757d4ee0bad84b33f5b3414f0d5fdf3d3f5b06e7d304a7ccf1a1"
      },
      {
        "id": "de6cdd20-bcec-4baa-9d7e-92c609a9a226",
        "name": "1e1d25391cf825d9607f652249e33cf1d2b98f260b587a1b1b33710e2ea6b91f"
      },
      {
        "id": "f0259d0f-ed25-4af0-aa65-200a2cce690e",
        "name": "3e881c9663db5c80a0093f4b0f7008aa1e73866c57aa672e53b38274df4c2807"
      },
      {
        "id": "f448cf1e-1d7e-4a67-9b7d-d347ba46b035",
        "name": "158.94.208.104"
      },
      {
        "id": "84af35d9-cee9-4ed3-b5c7-c782b754c831",
        "name": "fa25acfac32c557f809ab544764d4348f31cf9909ad9d512883d6cba8369ba88"
      },
      {
        "id": "dd1e3d1b-5d2d-4700-9637-e91bf75e877e",
        "name": "425501b6428e19536be925b4a286f73ae94270bc23ac516832ea27ba6c875998"
      },
      {
        "id": "db43fa8c-49ae-457f-9c6d-3887511b1409",
        "name": "humansbad2026.com"
      },
      {
        "id": "a6c1dc3d-1395-4acc-8292-792a9c9762ff",
        "name": "http://humansbad2026.com/track.php?d="
      },
      {
        "id": "0310940d-972d-421a-bde2-c444a3d201df",
        "name": "158.94.208.92"
      },
      {
        "id": "8e8ff0b1-3dce-4c15-b656-0e41ea7804e0",
        "name": "7eb345c26a1b827e7b2ef5b7881cb406b04b056ebc36cc92e3f7643decd2671f"
      },
      {
        "id": "7346e007-8316-4728-9378-4a154db15d0d",
        "name": "91255813151e6fb3d2a45e088490214c110ff035bbd1ee01ff430782868c77b3"
      },
      {
        "id": "18b4a655-e0b3-4cd6-96bf-936e1217677f",
        "name": "2afa7b6f825ae82c0121117b2966c57d825e7f1cfecaef36e638f66a08060db6"
      },
      {
        "id": "aa38d466-63f9-4d13-a87a-eca25eec51ea",
        "name": "71f19394bf15ae47b668fcbe13d0fe4d46d8c06ce004eeccf82c8d1770bba558"
      },
      {
        "id": "297907c4-0920-4718-85fc-a13ee8ad4c2b",
        "name": "9a736f4812b485f9cf5b1332a791b205b5135a4b3a0c41f473ad9cc9fbe2d75c"
      },
      {
        "id": "66d1b05b-7379-42eb-92b5-d6622eea4667",
        "name": "cirealci.com"
      },
      {
        "id": "c754615d-fade-4c0c-8b46-8c53f6f9f925",
        "name": "94.26.83.190"
      },
      {
        "id": "a18d29df-8421-4a1d-93cb-2a96ddd5dba3",
        "name": "809d030d1fd65c909260b4b33bff9c99f775aea332d944ad1f64b4e5e81a6d60"
      },
      {
        "id": "c30dd508-0530-49a7-8895-b0f469996096",
        "name": "91.92.243.161"
      },
      {
        "id": "664fdc98-4562-4788-8b77-ddf295bc5ef0",
        "name": "d79a454beabcd59459c350c71598bffd6badb6a8905b0e9fa3c1ee22cbef7d7e"
      },
      {
        "id": "b81c19bf-b72f-429a-adb5-ef01f3ca0408",
        "name": "http://91.92.243.161:3038"
      },
      {
        "id": "25e8ad1b-66c9-4613-8124-7e24a79c5317",
        "name": "http://89.124.81.216:9000/wbinjget?q=B2E581C85432BD4DF6A59A00CBDA1CB3"
      },
      {
        "id": "4ba62d84-f120-41f0-98e9-ae903c9bcccc",
        "name": "e38550a29e4ff48d8cd4df5ab34a88b9b28f23d50e66129c896689cd334849a9"
      },
      {
        "id": "2a5d3278-d334-4ba1-96d7-13602c43b2f8",
        "name": "77.238.248.158"
      },
      {
        "id": "77481c77-250e-4410-8430-751e5c333f36",
        "name": "0c0dc13805564d986b5eac6c5e8c90d336256fbb7f8a0c52180f1f5c690fe203"
      },
      {
        "id": "bd3e7c26-59f5-4d1b-a21a-691d997e0491",
        "name": "http://94.26.83.190:6600/t36umsn9/DataRescueCommunity"
      },
      {
        "id": "19fb9782-ba2d-4da3-8057-aef0098ffbab",
        "name": "95.163.152.190"
      }
    ],
    "attack_patterns": [
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      }
    ],
    "observables": [
      {
        "id": "94610e38-7b1e-4d51-ad2f-e201e9eb1bcb",
        "name": "cirealci.com"
      },
      {
        "id": "10209b58-429c-4932-a175-621c974f2356",
        "name": "humansbad2026.com"
      },
      {
        "id": "0804139f-f67e-4a25-88e2-cec80ac12e25",
        "name": "91.92.243.161"
      },
      {
        "id": "2d51375a-5c14-48c3-92c1-fde2a550f66c",
        "name": "95.163.152.190"
      },
      {
        "id": "be2eb771-3c06-454d-8db4-4144142236d1",
        "name": "77.238.248.158"
      },
      {
        "id": "cdecc4fc-4c7a-4b56-ae3b-2774ce77fd67",
        "name": "94.26.83.190"
      },
      {
        "id": "9d5d0192-517f-4e8a-8ce3-474ee47e5409",
        "name": "158.94.208.92"
      },
      {
        "id": "e664074b-50dc-4d54-b92e-ad67ec77c8b9",
        "name": "158.94.208.104"
      },
      {
        "id": "58feca5b-e6e2-4bbc-bbfd-8a160e25ccf9",
        "name": "89.124.81.216"
      },
      {
        "id": "89e9e462-5a91-4a24-b09e-3397eb6b6266",
        "name": "http://94.26.83.190:6600/t36umsn9/DataRescueCommunity"
      },
      {
        "id": "f15af533-e1ba-4835-9457-7e46a9ec980c",
        "name": "http://89.124.81.216:9000/wbinjget?q=B2E581C85432BD4DF6A59A00CBDA1CB3"
      },
      {
        "id": "a283ceb0-1f7d-4711-a425-f14d14aa5890",
        "name": "http://91.92.243.161:3038"
      },
      {
        "id": "c2bd38fc-3e5c-4ccf-85e2-bbd7c8eb8b74",
        "name": "http://humansbad2026.com/track.php?d="
      },
      {
        "id": "193d8e17-53b2-49eb-b8ee-2b03c4a13952",
        "name": "http://95.163.152.190/linguist.zip"
      }
    ]
  },
  "external_refs": [
    {
      "id": "30598f7e-e162-4a5e-929d-ef8e59d228ab",
      "standard_id": "external-reference--23b54c70-4531-5df6-ba94-cc3512aba885",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a47b2801372aa9b4096b194",
      "hash": null,
      "external_id": "6a47b2801372aa9b4096b194",
      "created": "2026-07-03T12:54:15.269Z",
      "modified": "2026-07-03T12:54:15.269Z",
      "createdById": null
    },
    {
      "id": "57d76d56-ace5-42db-9133-9217b6e6a2e1",
      "standard_id": "external-reference--73440bff-f346-52dd-b16b-0dbf10d5edce",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.morphisec.com/blog/what-is-the-babadeda-loader-analysis-of-a-new-clickfix-malware-campaign/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-03T12:54:15.321Z",
      "modified": "2026-07-03T12:54:15.321Z",
      "createdById": null
    }
  ]
}