> Family · Unclassified Batch Self-Extract .NET Dropper_

~/packetpursuit $ cat /intel/families/unclassified-batch-selfextract-dotnet-dropper.md

typeentityconfidencelowcreated2026-07-08updated2026-07-08scriptdropperdotnetobfuscationdefense-evasionexecutionc2

Unclassified Batch Self-Extract .NET Dropper

A batch-script dropper family that embeds a gzip-compressed, byte-reversed .NET Framework payload inside the .bat file itself. The outer script uses Unicode variable-name obfuscation and a %~0.Seu self-copy trick to hide the archive. A PowerShell cradle decodes, decompresses, reverses, and reflectively loads the inner assembly. The inner payload is ConfuserEx-obfuscated and carries encrypted .NET resources.

Current cluster size: 1 confirmed sibling. Low-confidence family pending additional samples.

Capabilities

  • batch-selfextract-gzip-reversed-payload
  • unicode-variable-name-obfuscation
  • powershell-reflective-assembly-load
  • confuserex-dotnet-obfuscation
  • system-web-c2-surface
  • encrypted-manifest-resources
  • shipping-document-social-engineering
  • self-contained-offline-dropper

Build / RE

  • Outer language: DOS batch (cmd.exe) with inline PowerShell cradle
  • Inner language: .NET Framework 4.5 PE32, compiled Sep 2024
  • Obfuscation: ConfuserEx (semantic English rename, not classic #=q…==)
  • Payload encoding: GZip → Base64 → byte reversal (stored backwards in archive)
  • Anti-analysis: Unicode variable names defeat naive string extraction; byte reversal prevents MZ signature matching on the gzip payload; self-copy to .Seu masquerades the archive attachment
  • Code quality: Moderate — the batch variable expansion is mechanically generated but consistent; the PowerShell cradle is a single-line concatenation pattern

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 Batch script spawns powershell.exe
Execution T1059.001 Inline PowerShell with -WindowStyle Hidden
Defense Evasion T1027.010 Unicode variable-name obfuscation + byte reversal
Defense Evasion T1027.002 Self-copy to .Seu archive attachment
Defense Evasion T1620 Reflective .NET assembly load via Assembly.Load(byte[])
Command and Control T1071.001 System.Web imports suggest HTTP C2 surface (static inference)

Sibling Analyses

  • 51500e40 — First observed sample: Arrival_Notice_Invoice_for_Container_No_FBLU0089027.bat, 2.4 MB, shipping-container lure, Sep 2024 compile timestamp. Static-only (text file, CAPE skipped). ^[/intel/analyses/51500e40881f7a9c6c0a556af80e9c93d35dd0f08472dafa3bf8ce899769f0c8.html]

Related