Stealthy BatLoader Malware Seen in Dozens of Attacks

guest · Nov 19, 2022

By Lindsey O’Donnell-Welch - November 15, 2022

Researchers are warning of a stealthy initial access malware called BatLoader that relies on various persistence and anti-detection tactics and has been seen in dozens of attacks since July.
Click to expand...

BatLoader, which was previously analyzed earlier in the year by Mandiant researchers, has since been seen by VMware researchers in at least 43 infections that have primarily targeted business services, financial services, manufacturing and education organizations, they said on Monday.

“BatLoader’s stealth and persistence are what made this malware stand out from the rest during its latest campaign,” according to Bethany Hardin, Lavine Oluoch and Tatiana Vollbrecht, with VMware.
“As this variant has a focus on persistence, if it was able to successfully infect the host, it would be vital to perform the necessary analysis to fully remove the malware or restore from a known good backup.”
Click to expand...

Additionally, the malware uses a tool called Nsudo to complicate remediation. Nsudo is typically used to launch programs with elevated privileges, but the actors use the tool to add various registry values - including ConsentPromptBehaviorAdmin, Notification_Suppress, DisableTaskMgr, DisableCMD and DisableRegistryTools - to the system configuration, which restricts user access on the infected device, said researchers.
Click to expand...

BATLOADER: The Evasive Downloader Malware

By Bethany Hardin, Lavine Oluoch, Tatiana Vollbrecht - November 14, 2022
Executive Summary
Named by Mandiant [1], BatLoader is an initial access malware that heavily uses batch and PowerShell scripts to gain a foothold on a victim machine and deliver other malware. The threat actors utilize search engine optimization (SEO) poisoning to lure users to download the malware from compromised websites. The use of living-off-the-land binaries makes this campaign hard to detect and block especially early on in the attack chain.

In this article, we will explore this malware campaign, addressing the history of BatLoader, its attributes, how it is delivered, the infection chain, and Carbon Black’s detection of the malware.
Click to expand...

Log in or Sign up

Stealthy BatLoader Malware Seen in Dozens of Attacks

guest Guest

Log in or Sign up

Stealthy BatLoader Malware Seen in Dozens of Attacks

guest Guest

Useful Searches