CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain

This technical analysis details a sophisticated sideloading infection chain (ClickFix lure → signed IBM SPSS WinWrapIDE.exe → decoy DLLs → EnumTimeFormatsEx trampoline → BabaDeda shellcode) that deploys a 1.14 MB x64 remote administration implant named CNCMachineRMS. The implant contains a custom scripting language, strong persistence (7 mechanisms), local account backdoor, reconnaissance, interactive shell, screen capture, and a unified container for config/state/C2; the report includes IOCs (domains, IP, file paths, and multiple SHA256 hashes) and behavioral detection notes (600s beacon, DoH usage, VM-evasion via C:\Intel).