A Batch File That Delivers Different Types of Malware

Several malware families have been delivered to victims through various stages of the attack. One of the common methods for delivering ransomware, RATs, and Cryptojackers was using a batloader. A batloader is a file that can perform various malicious activities when executed.

Batloaders have become increasingly popular among threat actors due to their simplicity in delivery, execution, and additional capabilities. Cybercriminals and APT groups are widely adopting it.

EHA

Document

Protect Your Storage With SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

Technical Analysis

Batloaders are often delivered via phishing emails, luring the victims to run a malicious file on their system. The most common batloader script used was found to be highly obfuscated. However, deobfuscating the batch script provided the actions of the batch script.

The batch script copies a powershell.exe executable to a location specified by %temp%Lroxmuu.png. It also copies the current batch file to a location specified by %temp%Lroxmuu.png.bat.

Obfuscated batch file (Source: Seqrite) — *Obfuscated batch file*

The PowerShell commands in the script execute another script with a custom parameter -win, which expects a base64-encoded string argument. Further analysis revealed that the script performs dynamic code loading and execution from a base64-encoded source in the current batch script.

Finally, an executable .NET file was injected into a process based on the specific malware family. This file also establishes a connection with the Command and Control server for extracting additional payload in certain cases.

A complete report about this batloader has been published, which provides detailed information about the source code, analysis, and additional information.