> Family · Unclassified Batch Skip-4 PowerShell Dropper_

~/packetpursuit $ cat /intel/families/unclassified-batch-skip4-powershell-dropper.md

typeentityfamilyunclassified-batch-skip4-powershell-dropperconfidencelowcreated2026-07-08updated2026-07-08scriptdropperdefense-evasionexecutionc2obfuscation

Unclassified Batch Skip-4 PowerShell Dropper

A batch-script dropper family that wraps a PowerShell payload obfuscated with a stride-4 character-skip cipher and a Base64+XOR multi-layer decoder. The outer wrapper is a single-line .bat file with a Portuguese-language purchase-order masquerade. The inner PowerShell uses custom function names (bjergan, containe, Lancetfish, Gnotobioti) to implement noise-padded literal decoding, payload decryption, and in-memory execution via IEX.

Current cluster size: 1 confirmed sibling. Low-confidence family — awaiting additional samples to confirm tooling persistence.

Capabilities

  • batch-powershell-stager
  • character-skip-obfuscation-stride4-offset58
  • base64-xor-layered-payload-decode
  • google-drive-c2-download
  • firefox-ua-masquerade
  • appdata-staging-path
  • in-memory-iex-execution
  • sleep-loop-retry
  • tls12-enforcement
  • round-robin-url-failover

Build / RE

  • Language: DOS batch (cmd.exe) with inline PowerShell
  • Obfuscation: Custom multi-layer — stride-4/offset-58 character-skip cipher on noise-padded literals; Base64 encoding; 10-byte XOR (Gigtramtin key)
  • Anti-analysis: No anti-VM or anti-debug; relies on text-file triviality to evade sandbox detonation
  • Code quality: Moderate — the obfuscation is manually crafted and layered, but contains dead-code assignments and unused variables ($global:Rudetv, $shrewde) suggesting incomplete development or placeholder expansion
  • Linguistic register: Mixed Danish + medical/zoological Latin variable names; distinct from pure-Danish NSIS cluster

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 Batch script spawns powershell.exe
Execution T1059.001 Inline PowerShell with -NoProfile
Command and Control T1105 Net.WebClient.DownloadFile to Google Drive
Defense Evasion T1027.010 Triple-layer obfuscation (char-skip + Base64 + XOR)
Defense Evasion T1620 IEX reflective in-memory execution
Command and Control T1071.001 HTTPS GET to drive.google.com
Virtualization/Sandbox Evasion T1497.001 Firefox 150.0 non-existent version masquerade

Sibling Analyses

  • be44b0c3b1a11814cbf7709d5d797d40e81df3836b34ec055202a22b21c6e3f2 — First observed sample: Pedido_de_Cotação_nº_21052026_lista_comercial.bat, 4,273 bytes, Google Drive C2, stride-4/offset-58, XOR key Gigtramtin. Static-only (text file, CAPE skipped). ^[/intel/analyses/be44b0c3b1a11814cbf7709d5d797d40e81df3836b34ec055202a22b21c6e3f2.html]

Related