APT24 BADAUDIO First-Stage Downloader Execution

Daniel Jeremiah@daniyyell

•updated Jan 18, 2026•0•27

Detects the execution of a DLL that contains specific cryptographic function calls (SystemFunction036 or RtlGenRandom) and is launched by common DLL loading mechanisms (rundll32.exe, regsvr32.exe, or mshta.exe). This pattern is indicative of the BADAUDIO malware, a first-stage downloader used by APT24, which is known for using SystemFunction036 for cryptographic operations and being delivered as a DLL.