Malware
BADAUDIO
According to Google, BADAUDIO is a custom first-stage downloader written in C++ that downloads, decrypts, and executes an AES-encrypted payload from a hard-coded command and control (C2) server.
BADAUDIO is a Windows malware family operated by APT24.
Background
Google reports that BADAUDIO is a bespoke first-stage downloader written in C++ that retrieves, decrypts, and runs an AES-encrypted payload from a hard-coded command and control (C2) server. It gathers basic host information, encrypts that data with a hard-coded AES key, and transmits it as a cookie value within the GET request used to pull down the payload. Using the same key, the payload, identified in one instance as Cobalt Strike Beacon, is decrypted and run directly in memory.
Source: Malpedia (Fraunhofer FKIE).