Malware
We
look
into
BatCloak
engine,
its
modular
integration
into
modern
malware,
proliferation
mechanisms,
and
interoperability
implications
as
malicious
actors
take
advantage
of
its
fully
undetectable
(FUD)
capabilities.
In
our
recent
investigation,
we
discovered
the
use
of
heavily
obfuscated
batch
files
utilizing
the
advanced
BatCloak
engine
to
deploy
various
malware
families
at
different
instances.
Running
analysis
and
sample
collection
from
September
2022
to
June
2023,
we
found
that
these
batch
files
are
designed
to
be
fully
undetectable
(FUD)
and
have
demonstrated
a
remarkable
ability
to
persistently
evade
security
solutions.
As
a
result,
threat
actors
can
load
various
malware
families
and
exploits
by
leveraging
highly
obfuscated
batch
files
seamlessly.
Our
initial
research
titled
“The
Dark
Evolution:
Advanced
Malicious
Actors
Unveil
Malware
Modification
Progression”
delves
into
the
continuing
evolution
of
BatCloak,
uncovering
the
modifications
that
have
propelled
modern
malware
to
new
levels
of
security
evasion.
This
is
the
first
entry
in
a
three-part
technical
research
series
taking
an
in-depth
look
at
the
continuing
evolution
of
the
highly
evasive
batch
obfuscation
engine
BatCloak.
The
second
part
of
this
series
will
look
into
the
remote
access
trojan
(RAT)
SeroXen,
a
piece
of
malware
gaining
popularity
for
its
stealth
and,
in
its
latest
iterations,
targets
gamers,
enthusiast
communities,
and
organizations.
Aside
from
the
RAT’s
own
tools,
we
will
look
into
the
updated
BatCloak
engine
included
as
SeroXen’s
loading
mechanism.
The
third
and
last
part
of
this
series
will
detail
the
distribution
mechanisms
of
SeroXen
and
BatCloak.
We
also
include
our
security
insights
on
the
community
and
demographic
impact
of
this
level
of
sophistication
when
it
comes
to
batch
FUD
obfuscation.
Defying
detection:
A
preview
of
BatCloak
engine’s
efficacy
We
analyzed
hundreds
of
batch
samples
sourced
from
a
public
repository.
The
results
showed
a
staggering
80%
of
the
retrieved
samples
exhibiting
zero
detections
from
security
solutions.
This
finding
underscores
the
ability
of
BatCloak
to
evade
traditional
detection
mechanisms
employed
by
security
providers.
Moreover,
when
considering
the
overall
sample
set
of
784,
the
average
detection
rate
was
less
than
one,
emphasizing
the
challenging
nature
of
identifying
and
mitigating
threats
associated
with
BatCloak-protected
pieces
of
malware.
1.
BatCloak
detection
counts
from
a
public
repository;
samples
and
detection
results
collected
from
September
2022
to
June
2023
Understanding
the
evolving
landscape
of
advanced
malware
techniques
such
as
FUD
obfuscator
BatCloak
enables
us
to
develop
more
effective
strategies
for
combating
the
ever-evolving
threats
posed
by
these
sophisticated
adversaries.
These
findings
highlight
the
pressing
need
for
enhanced
approaches
to
malware
detection
and
prevention,
such
as
a
cutting-edge multilayered
defensive
strategy and comprehensive
security
solutions.
Download
the
first
part
of
our
analysis
on
BatCloak
engine
here.
Tags
Authors
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
About Author
