3f9176f2248abaeb0277a79ad534da2ef92dcb881024f5ef17b1e082dd262a6aanydesk-batch-dropper: 3f9176f2 — Batch-script AnyDesk stager with SMTP exfil and task-scheduler persistence
Executive Summary
An 854-byte Windows batch script (pop.bat) that stages AnyDesk with a hardcoded unattended-access password, archives the victim's AnyDesk configuration, exfiltrates it via the blat SMTP client to a Dutch inbox, and establishes persistence via a logon-triggered scheduled task. All tooling is commodity or legitimate; the script itself is the payload. Static-only analysis (CAPE skipped ASCII text).
What It Is
- SHA-256:
3f9176f2248abaeb0277a79ad534da2ef92dcb881024f5ef17b1e082dd262a6a - File type: ASCII text, DOS batch file, 854 bytes ^[file.txt]
- Filename:
pop.bat - CAPE: Skipped — unsupported binary class ^[dynamic-analysis.md]
Build / RE
Language / format: Plain DOS batch (cmd.exe interpreter). No packer, no obfuscation, no encoding. ^[file.txt]
Code quality: Extremely low — bare commands with hardcoded paths, credentials, and a typo in the task name (Auto apdate). ^[strings.txt:7] The script assumes a pre-populated staging directory (%userprofile%\Trust\mipo\) containing AnyDesk\AnyDesk.exe, driver.exe (WinRAR), blat.exe, AnyDesk.rar, and Trays\Trays.exe.
Anti-analysis: None. No debug checks, no VM detection. Relies on being a trivial text file that sandboxes may skip.
Embedded resources / staging: The script references external binaries it expects to already exist in the staging directory:
AnyDesk\AnyDesk.exe— legitimate AnyDesk client ^[strings.txt:4]driver.exe— likely renamed WinRAR (a -r -ep -hare RAR archive switches) ^[strings.txt:5]blat.exe— open-source Win32 SMTP client ^[strings.txt:6]Trays\Trays.exe— unknown payload, launched as-traymasquerade ^[strings.txt:7]
Deploy / ATT&CK
| Tactic | Technique | Evidence |
|---|---|---|
| Execution | T1059.003 (Windows Command Shell) | cmd.exe /c batch script. ^[file.txt] |
| Persistence | T1053.005 (Scheduled Task/Job: Scheduled Task) | schtasks /create /tn "Auto apdate" /tr ... /sc onlogon /rl highest ^[strings.txt:7] |
| Defense Evasion | T1070.004 (Indicator Removal: File Deletion) | del /q %userprofile%\Trust\mipo\*.{cmd,txt,rar,exe,pdf} ^[strings.txt:1,2,8,9,10] |
| Defense Evasion | T1219 (Remote Access Software) | Hardcodes AnyDesk unattended-access password QWERTY1234566. ^[strings.txt:4] |
| Collection | T1560 (Archive Collected Data) | WinRAR archives %ProgramData%\AnyDesk into AnyDesk.rar with password limpid2903392. ^[strings.txt:5] |
| Exfiltration | T1048.003 (Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol) | blat.exe SMTP to in@okbm-bus.nl via mail.versio.nl:587. ^[strings.txt:6] |
C2 / Infrastructure:
- Remote access: AnyDesk with hardcoded password
QWERTY1234566and unattended-access flag. ^[strings.txt:4] - Exfil: SMTP via
mail.versio.nl(Dutch hosting provider, Versio/Hostnet) on port 587. Credentials:out@okbm-bus.nl/Kw52heHEBP5Rwe8D99CW. ^[strings.txt:6] - Recipient:
in@okbm-bus.nl— domain with Dutch geographic association.
Attribution / Locale:
- Dutch infrastructure indicators (
versio.nl,okbm-bus.nl). ^[strings.txt:6] - Task name typo (
apdateinstead ofupdate) suggests non-native English or careless typing. ^[strings.txt:7]
Related
- anydesk-batch-dropper — Entity page for this family/pattern.
- legitimate-remote-access-tool-abuse — Concept page covering AnyDesk, NetSupport, ScreenConnect abuse.
- schtasks-onlogon-persistence — Procedure page for logon-triggered scheduled tasks.