#How to make a batch virus code#

But cmd.exe will interpret it and execute it, and that old-school shell is the tried and true built-in that hackers know will be on a target system,' said Hammond. It looks like random letters, in a random order, with random percent-signs thrown all around.

#How to make a batch virus code#

'On the surface, this code is completely unintelligible. Hammond notes although antivirus productsВ could easily scan plain-text batch scripts, the fact an attacker has gone through multiple steps to obfuscate a simple one-line command would make it virtually impossible for an 'off-the-shelf' EDR orВ signature-based antivirus productВ to detect such samples.ДЇurther, the signature detection can be avoided given there are various ways an attacker could obfuscate the same payload, each producing a different signature. 'But since this offers great access to the computer system, threat actors and malware families take advantage of. 'System administrators often make use of batch scripting to make their lives easier and speed up their workflow,' says John Hammond, Senior Security Researcher at Huntress Labs. The binary in question, ' ulib8b4.exe' is TrickBot's payload that performs a wide range of malicious activity, including stealing a domain'sВ Active Directory Services database, spreading laterally on a network, screenlocking, stealing cookies and browser passwords, and stealingВ OpenSSH keys. When deciphered, all the code did was launch the malware, an action that could have been triggered by just a single line of code: Recently, researchers at Huntress Labs discovered anotherВ TrickBotВ sample that used a similar batch scriptВ with overВ 40 lines of obfuscated code. The obfuscated batch script launcher.bat further runsВ the EXE payload In our analysis, BleepingComputer had observed aВ BAT script launcher.batВ being run by a scheduled task set up by TrickBot. TrickBot is known to finish an attack by giving access to threat actors who deploy either the Ryuk or Conti ransomware on the compromised network. When installed, TrickBot will quietly run on a victim's computer while it downloads other modules to perform different tasks. TrickBot is a malware infection commonly installed via malicious phishing emails or other malware. Over the weekend, BleepingComputer's Lawrence Abrams analyzed the hundredth build of TrickBotВ and its new features. TrickBot deploys ransomware via obfuscated BAT scripts

The fact that batchВ scripts need noВ interpreter but Microsoft Windows' inbuilt command promptВ makes this evasion techniqueВ self-contained and minimalistic.

One such capability is its use ofВ an obfuscated batchВ scriptВ launcherВ to jumpstartВ malicious executables. With the 100th release of TrickBot, the malware came equipped with new and advanced evasiveВ capabilities.