> Family · Unclassified Batch String-Slice Dropper Family_

~/packetpursuit $ cat /intel/families/unclassified-batch-string-slice-dropper.md

typeentityfamilyunclassified-batch-string-slice-dropperconfidencelowcreated2026-06-17updated2026-06-19scriptdropperexecutiondefense-evasionobfuscation

Unclassified Batch String-Slice Dropper Family

Windows batch-script droppers that obfuscate plaintext commands by indexing into a single shared character-array variable using %Z:~n,1% substring expansion. The master string (typically 60–80 characters) is stored once in a SET assignment; every command character is then emitted by referencing the appropriate index. This is distinct from the batch-powershell-variable-expansion-obfuscation family, which fragments payloads across dozens of SET variables and reassembles them via %VAR% concatenation.

Capabilities

  • batch-script-character-array-slice-obfuscation
  • local-python-runtime-staging
  • sequential-py-payload-execution
  • self-cleanup-del-wildcard
  • folder-hide-attrib
  • staged-zip-payload-extraction

Build / RE

  • Language: DOS batch (cmd.exe interpreter)
  • Obfuscation: Manual character-array indexing. No commercial packer. A single SET "Z=…" line holds a 60–80 character alphabet; all subsequent commands are built from %Z:~n,1% expansions. ^[sample aa443a52/strings.txt:1-500]
  • Anti-analysis: None. Relies on static tools failing to resolve the substring expansions.
  • Code quality: Low — verbose repetitive patterns, no error handling, hardcoded paths.
  • Signing: None.

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 (Windows Command Shell) Batch script assembly and launch ^[sample aa443a52/decoded.txt]
Execution T1059.006 (Python) Sequential python.exe 1.py through 7.py ^[sample aa443a52/decoded.txt]
Defense Evasion T1027 (Obfuscated Files or Information) Character-array slicing hides commands from static string extraction ^[sample aa443a52/strings.txt]
Defense Evasion T1070.004 (Indicator Removal: File Deletion) Deletes new.bat and FTSP.zip after execution ^[sample aa443a52/decoded.txt]
Defense Evasion T1564.001 (Hide Artifacts: Hidden Files and Directories) attrib +h on %USERPROFILE%\Downloads\Print ^[sample aa443a52/decoded.txt]

Sibling Analyses

  • aa443a52851efff9b5c218c82c0ff54e9b87d6100ae80e915f3a8cca41d107b6 (random.bat) — First observed sample: UTF-8 BOM encoded, stages Python 3.12 under Downloads\Print\Python312, executes seven .py scripts, cleans up FTSP.zip and new.bat, hides Print folder. Broken %USERPROFILE% expansion (bare backslash paths). ^[/intel/analyses/aa443a52851efff9b5c218c82c0ff54e9b87d6100ae80e915f3a8cca41d107b6.html]
  • eae731d3ad19c8258854dd7df817003a24361c44fb43ca91e2ed076182beab64 (VT_startupppp.bat) — Second observed sample: UTF-16 LE encoded with BOM, same 64-char master alphabet and %Z:~n,1% obfuscation engine. Corrected %USERPROFILE% expansion. VT filename prefix suggests VirusTotal testing. Report includes updated YARA/Sigma rules targeting UTF-16 LE encoding. ^[/intel/analyses/eae731d3ad19c8258854dd7df817003a24361c44fb43ca91e2ed076182beab64.html]

Related