cloudflare.bat

The video analyzes a malicious Windows batch script named "cloudflare dobat" that acts as a multi-stage malware payload, ultimately dropping a Remote Access Trojan (RAT) called Xorm. The script uses obfuscation and variable manipulation to evade detection, with stages involving PowerShell and .NET assemblies to bypass security mechanisms like AMSI and disable network access to security solutions. The final payload, Xorm, establishes a C2 connection to an IP address (45.88.186.152) and includes capabilities for keylogging, command execution, and anti-analysis techniques.

Key Takeaways:
• The "cloudflare dobat" batch script obfuscates its code using random variables and delayed expansion to evade detection 0:40-1:30.
• The script invokes a PowerShell stage 2 that decrypts and decompresses payloads, using AES-CBC encryption and base64 encoding to hide malicious content 1:30-2:50.
• Payload 1 is an AMSI bypass that disables Windows Defender's antimalware scanning by patching memory and functions 2:50-3:25.
• Payload 2 disables access to security vendors (e.g., Norton, Bitdefender) by modifying the hosts file and disables system restore and EDR via registry and scheduled tasks 3:25-4:30.
• The malware ultimately drops a stage 4 Xorm RAT, which connects to C2 at 45.88.186.152 on port 4782 and performs keylogging and command execution 4:30-5:30.

The attack chain begins with a fake "Cloudflare" capture popup, which triggers the malware after a user opens the Run dialog, demonstrating a sophisticated social engineering and post-exploitation strategy.

Sources:

• 0:40 Discussion of batch script obfuscation and variable patterns.