> Family · AnyDesk Batch Dropper Family_

~/packetpursuit $ cat /intel/families/anydesk-batch-dropper.md

typeentityfamilyanydesk-batch-dropperconfidencemediumcreated2026-06-13updated2026-06-13scriptdropperpersistencec2defense-evasionlegitimate-remote-access-tool-abuseexfiltration

AnyDesk Batch Dropper Family

Windows batch-script droppers that stage legitimate AnyDesk with a hardcoded unattended-access password, archive the victim's configuration, exfiltrate credentials via SMTP using the blat mail client, and establish persistence via a logon-triggered scheduled task. All tooling is commodity; the script itself is the only custom component.

Capabilities

  • batch-script-anydesk-unattended-access-password-staging
  • winrar-archive-collected-data-with-password
  • blat-smtp-exfiltration-over-unencrypted-protocol
  • schtasks-onlogon-persistence
  • stage-cleanup-via-del-wildcard

Build / RE

  • Language: Plain DOS batch (cmd.exe interpreter). No packer, no obfuscation, no encoding. ^[sample 3f9176f2/file.txt]
  • Code quality: Extremely low — bare commands with hardcoded paths, credentials, and typos (e.g. Auto apdate). ^[sample 3f9176f2/strings.txt:7]
  • Anti-analysis: None. Relies on being a trivial text file that sandboxes may skip.
  • Staging assumptions: The script expects a pre-populated directory (%userprofile%\Trust\mipo\) containing:
    • AnyDesk\AnyDesk.exe — legitimate AnyDesk client
    • driver.exe — likely renamed WinRAR (archive switches a -r -ep -h) ^[sample 3f9176f2/strings.txt:5]
    • blat.exe — open-source Win32 SMTP client ^[sample 3f9176f2/strings.txt:6]
    • Trays\Trays.exe — unknown secondary payload launched with -tray masquerade ^[sample 3f9176f2/strings.txt:7]

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 Batch script interpreter.
Persistence T1053.005 schtasks /create /sc onlogon /rl highest ^[sample 3f9176f2/strings.txt:7]
Defense Evasion T1070.004 del /q wildcard cleanup of staging directory. ^[sample 3f9176f2/strings.txt:1,2,8,9,10]
Defense Evasion T1219 AnyDesk with hardcoded password QWERTY1234566. ^[sample 3f9176f2/strings.txt:4]
Collection T1560 WinRAR password-protected archive of AnyDesk config. ^[sample 3f9176f2/strings.txt:5]
Exfiltration T1048.003 blat.exe SMTP to in@okbm-bus.nl via mail.versio.nl:587. ^[sample 3f9176f2/strings.txt:6]

Infrastructure

  • SMTP server: mail.versio.nl (port 587) — Dutch hosting provider.
  • Exfil credentials: out@okbm-bus.nl / Kw52heHEBP5Rwe8D99CW.
  • Recipient: in@okbm-bus.nl.
  • Remote access password: QWERTY1234566.
  • Archive password: limpid2903392.

Locale / Attribution

  • Dutch infrastructure indicators (versio.nl, okbm-bus.nl domain registration).
  • Task name typo (Auto apdate for Auto update) suggests non-native English or careless operator.
  • No code-family overlap with other batch-script clusters in the corpus (e.g. unclassified-batch-powershell-dropper uses SET/GOTO variable expansion and PowerShell reflective loading; this family uses bare batch with commodity tools).

Sibling Analyses

  • 3f9176f2248abaeb0277a79ad534da2ef92dcb881024f5ef17b1e082dd262a6a — First observed sample (pop.bat, 854 bytes). ^[/intel/analyses/3f9176f2248abaeb0277a79ad534da2ef92dcb881024f5ef17b1e082dd262a6a.html]

Related

  • legitimate-remote-access-tool-abuse — Concept page for AnyDesk/NetSupport/ScreenConnect abuse patterns.
  • schtasks-onlogon-persistence — Procedure page for logon-triggered scheduled tasks.