unclassified-batch-string-slice-dropper: eae731d3 — FTSP.zip Python stager, UTF-16 LE variant with corrected %USERPROFILE% expansion

Executive Summary

A 6.7 KB Windows batch script (VT_startupppp.bat) that is a confirmed sibling of the unclassified-batch-string-slice-dropper cluster (aa443a5285). It uses the identical 64-character master string and %Z:~n,1% substring-slice obfuscation engine, but differs in three ways: UTF-16 LE encoding (not UTF-8 BOM), a combining-character variable name (ôZ in UTF-16 LE, decoded as ôZ in UTF-8 replacement), and corrected %USERPROFILE% path expansion where the sibling used broken bare backslash paths. The script stages a local Python 3.12 runtime under %USERPROFILE%\Downloads\Print\Python312\, executes seven .py payloads, then self-cleans and hides the staging folder. No network C2, no persistence, no anti-analysis — pure commodity-tier local staging.

What It Is

• File: VT_startupppp.bat ^[metadata.json]
• Type: Unicode text, UTF-16 LE, with very long lines (3358) ^[file.txt]
• Size: 6 719 bytes ^[triage.json]
• SHA-256: eae731d3ad19c8258854dd7df817003a24361c44fb43ca91e2ed076182beab64 ^[triage.json]
• Family: unclassified-batch-string-slice-dropper — second confirmed sibling. ^[/intel/analyses/aa443a52851efff9b5c218c82c0ff54e9b87d6100ae80e915f3a8cca41d107b6.html]
• Build: Hand-written batch; no packer, no compiler, no signing. Encoded in UTF-16 LE with BOM.

How It Works

Obfuscation Engine

The script stores a single 64-character master string in a SET assignment:

QlG4MmXfVkw@8oWg FZP3ORHezDiLBupcn7r1tvIjYqhJ6ba5KNC2xAT9y0sESdU

^[strings.txt:2]

Every plaintext character is emitted by expanding %Z:~n,1% where n is the zero-based index. In this sample, the variable name is prefixed with a combining diaeresis (ôZ in UTF-16 LE), producing %ôZ:~n,1% in the raw bytes. The substitution alphabet and the indexing logic are byte-for-byte identical to sibling aa443a5285. ^[strings.txt:1-500]

The UTF-16 LE encoding doubles the file size relative to ASCII and defeats naive strings-based extraction because every ASCII character is interleaved with a null byte. Static tools that do not decode UTF-16 LE will see only the master string and a wall of %…:~n,1% fragments. ^[file.txt]

Decoded Behavior

After de-obfuscation, the script performs the following:

1. Sets destination=%USERPROFILE%\Downloads\FTSP.zip.
2. Changes directory to %Userprofile%\Downloads\Print\Python312.
3. Executes python.exe 1.py through 7.py sequentially.
4. Deletes %USERPROFILE%\Downloads\new.bat if it exists.
5. Deletes %destination% (FTSP.zip) if it exists.
6. Sets attrib +h on %USERPROFILE%\Downloads\Print to hide the staging folder.

^[decoded.txt]

Sibling Delta vs aa443a5285

The VT prefix in the filename suggests this sample was uploaded to VirusTotal for detection testing — a common actor behavior when refining evasion. ^[metadata.json]

Missing Pieces

• No download cradle (curl, bitsadmin, certutil, powershell) is present in the decoded text. FTSP.zip and the seven .py payloads are assumed pre-staged by an earlier stage or delivered alongside the batch.
• No persistence mechanism in the batch itself. Persistence, if any, lives in the Python layer or a separate dropper.

Decompiled Behavior

N/A — plaintext batch script, not a compiled binary. No Ghidra or radare2 analysis applicable. Full logic recovered via manual substitution of %ôZ:~n,1% references against the master string after UTF-16 LE decoding.

C2 Infrastructure

No network indicators recovered. Strictly local execution — assumes pre-staged Python runtime and payload scripts.

Interesting Tidbits

• Corrected paths: Unlike the sibling, this sample properly expands %USERPROFILE%, meaning it will execute correctly on a standard Windows host without relying on the current working directory. This suggests iterative refinement between the two builds. ^[decoded.txt] ^[sample aa443a52/decoded.txt]
• VirusTotal filename: VT_startupppp.bat strongly implies a VirusTotal test upload. The triple-p (ppp) may be a version suffix or random padding to defeat hash-based clustering on VT. ^[metadata.json]
• UTF-16 LE as anti-static: Encoding the batch in UTF-16 LE doubles the file size and breaks standard strings extraction. Tools that do not decode UTF-16 LE will miss the obfuscated commands entirely. ^[file.txt]
• No error handling: The script does not check whether Python312 exists before cd into it. On a clean host, the python.exe calls would fail silently and cleanup would still run. ^[decoded.txt]
• Identical alphabet reuse: The 64-character master string is unchanged between siblings, confirming shared authorship or a copy-paste template. ^[strings.txt:2]

How To Mess With It (Homelab Replication)

Replication:

1. Write a batch script in Notepad.
2. Save it with Encoding → Unicode (UTF-16 LE) — this produces the BOM and interleaved nulls.
3. Set Z=<64-character alphabet>.
4. Encode every payload character as %Z:~n,1%.
5. Concatenate on single lines with %% escaping.
6. The result looks like a wall of UTF-16 garbage but executes normally under cmd.exe.

Defeat:

1. Strip the BOM (FF FE) and decode every second byte as ASCII, or use iconv -f UTF-16LE -t UTF-8.
2. Extract the master string from the set line.
3. Replace every %Z:~n,1% with Z[n].
4. Strip remaining %VAR% noise tokens.

Deployable Signatures

YARA Rule

rule Batch_StringSlice_UTF16_Obfuscation
{
    meta:
        description = "Batch script using %Z:~n,1% character-array slicing, UTF-16 LE encoded"
        author      = "pp-hermes"
        date        = "2026-06-19"
    strings:
        $bom      = { FF FE }
        $alphabet = "QlG4MmXfVkw@8oWg FZP3ORHezDiLBupcn7r1tvIjYqhJ6ba5KNC2xAT9y0sESdU" wide
        $tilde    = "~" wide
        $percent  = "%" wide
    condition:
        uint16(0) != 0x5a4d and
        $bom at 0 and
        $alphabet and
        #tilde > 50 and
        #percent > 100
}

Sigma Rule

title: UTF-16 LE Batch Script String-Slice Obfuscation Execution
status: experimental
description: Detects cmd.exe spawning python.exe after executing a UTF-16 LE encoded batch file containing %Z:~n,1% character-slice patterns.
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        CommandLine|contains: 'python.exe'
    selection_utf16:
        CommandLine|contains:
            - '~0,1%'
            - '~1,1%'
            - '~2,1%'
    selection_path:
        CommandLine|contains:
            - 'Downloads\Print\Python312'
            - 'FTSP.zip'
    condition: selection_parent and (selection_utf16 or selection_path)
falsepositives:
    - Legitimate batch files using substring extraction (rare in bulk)
level: medium

Behavioral Hunt Query (KQL)

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where FileName =~ "python.exe"
| where InitiatingProcessCommandLine contains "Downloads\Print\Python312"
| summarize count() by DeviceName, InitiatingProcessCommandLine, FolderPath

IOC List

Behavioral Fingerprint

This artifact is a UTF-16 LE encoded batch-script stager that relies on character-array substring slicing (%Z:~n,1%) to obfuscate its commands. It expects a pre-staged Python 3.12 runtime and seven sequentially-numbered .py scripts under %USERPROFILE%\Downloads\Print\Python312\. After execution, it deletes new.bat and FTSP.zip, then sets the Print folder to hidden. No network C2, no persistence, and no anti-analysis — the entire threat is local staging and cleanup. The VT filename prefix and corrected %USERPROFILE% expansion suggest this is a refined variant of a commodity dropper template tested on VirusTotal.

Detection Signatures

N/A — no capa, no floss, no YARA matches, and CAPE skipped because the file is a plaintext script. Detection relies on behavioral rules (process tree + command-line patterns) and static YARA against the obfuscation engine and UTF-16 LE encoding.

References

• Sibling analysis (same obfuscation engine): aa443a52851efff9b5c218c82c0ff54e9b87d6100ae80e915f3a8cca41d107b6 (random.bat) ^[/intel/analyses/aa443a52851efff9b5c218c82c0ff54e9b87d6100ae80e915f3a8cca41d107b6.html]
• Entity page: unclassified-batch-string-slice-dropper
• Related concept: batch-powershell-variable-expansion-obfuscation — different mechanism (SET/GOTO fragmentation vs single character array)

Provenance

• File type: file.txt (file command, v5.45)
• Strings: strings.txt (raw UTF-16 LE with BOM, manually decoded)
• Decoded payload: decoded.txt (manual substitution of %ôZ:~n,1% against master string after UTF-16 LE decode)
• Triage metadata: triage.json
• Master string: QlG4MmXfVkw@8oWg FZP3ORHezDiLBupcn7r1tvIjYqhJ6ba5KNC2xAT9y0sESdU (64 characters)
• Encoding: UTF-16 LE with BOM (FF FE)