New Stealthy BabbleLoader Malware Spotted Delivering WhiteSnake and Meduza Stealers

[Captain Awesome]

Content source

https://thehackernews.com/2024/11/new-stealthy-babbleloader-malware.html?m=1

Cybersecurity researchers have shed light on a new stealthy malware loader called BabbleLoader that has been observed in the wild delivering information stealer families such as WhiteSnake and Meduza.

BabbleLoader is an "extremely evasive loader, packed with defensive mechanisms, that is designed to bypass antivirus and sandbox environments to deliver stealers into memory," Intezer security researcher Ryan Robinson said in a report published Sunday.

New Stealthy BabbleLoader Malware Spotted Delivering WhiteSnake and Meduza Stealers

New stealthy malware loader BabbleLoader evades antivirus and sandboxes, delivering WhiteSnake and Meduza stealers globally.

thehackernews.com

 

[Andy Ful]

Loaders are often the first stage in an attack chain, designed to stealthily execute or inject malware, such as info-stealers or ransomware, into a target system. Their prevalence reflects an evolution in tactics, allowing threat actors to evade traditional antivirus defenses through techniques like in-memory execution and anti-analysis features. Widely available for purchase or lease on underground markets, loaders are now a commodity in malware distribution, making sophisticated attack methods accessible to a broader range of actors and adaptable across diverse campaigns and targets.

Babble Babble Babble Babble Babble Babble BabbleLoader

BabbleLoader: the annoyingly clever malware loader that jumbles, scrambles, and evades its way past modern defenses with frustrating ease.

intezer.com

Such malware can be used in widespread campaigns, making it dangerous for all users. The loaders can be signed in targeted attacks. In the original article (intezer.com) there are over 80 hashes of BabbleLoader (EXE files, all unsigned except for one properly signed and one with a fake certificate). The EXE malware that is unsigned or contains the fake certificate is blocked by Windows SmartScreen (on Windows 8+ when the file is downloaded from the Internet) or Smart App Control (on Windows 11).