Security researchers are warning that malware developers are adopting a handy obfuscation tool to sneak malware past antiviruses.
A batch file obfuscation engine, known as BatCloak, requires minimal programming skills to use. Among its recent successes is a recent remote access Trojan called SeroXen, which researchers from several companies said resists detection by antivirus and endpoint detection and response tools.
A SeroXen sample analyzed by AT&T in May failed to generate any detections on VirusTotal. Analysis published by Trend Micro earlier this month of hundreds of infected batch file samples taken from a public repository concluded that BatCloak shielded 80% of the files from detection by security software. Batch files, often marked with the .bat extension, are plain text files that contain scripts for a command-line interpreter.
SeroXen appeared in late 2022, retailing for $30 per month. It is a variant of the well-known Quasar RAT, AT&T reported. The hacker apparently behind SeroXen used another active website, seroxen.net, to distribute the Trojan—the site currently says sales have been suspended. The site promoted the malware as “completely undetectable,” or “FUD.”.
On Thursday, TrendMicro published an analysis reporting that one of the techniques BatCloak uses to hide SeroXen from detection is a sophisticated form of string manipulation, which obscures the malware's use of the Windows command-line interface to set environment variables via the "set" command.
SeroXen chains variables together to execute a command – a method used by malware developers to evade detection of malicious commands. Ultimately, it uses obfuscated PowerShell commands to decrypt and deliver a .NET loader.
The .bat loader first came to researchers’ attention as the obfuscation engine of Jlaive, an open-source batch file builder that began circulating among hackers in 2022. TrendMicro reports that the most recent version of the BatCloak engine is being sold as “ScrubCrypt.” Its developers’ decision to sell access, rather than debut a new open-source tool, is likely due to Jlaive’s success as well as their desire to leverage the project and protect it from unauthorized copying.
Information source: bankinfosecurity.com
