Encrypt, Hide and Sleep

Badgers are asynchronous in nature, which connect back to the Ratel server at a user provided interval. The sleep command provides a sleep and jitter (percentage) functionality which can totally randomize the checkin time utilized by the badger. If you provide a jitter value (percentage), then the sleep command sleeps randomly between the given sleep time and plus/minus a random value between sleep and sleep’s jitter percentage. For example, if you enter sleep 30 40, then the sleep time would be 20s +/- random value between 20 and (20 % 30).

The Badger uses a lot of anti-detection sleeping techniques, such as not using the usual Sleep API, encrypting the RX region, converting it to RW and using Wait timers and ROP gadgets. A more detailed explanation on Sleep Encryption was posted in the v0.7 release. When a badger is sleeping, all it’s tasks are paused, including pivot connections.

The below video provides a quick demonstration of the hiding the RX region in memory.