Unclassified Danish Batch PowerShell Dropper Family
Windows batch-script droppers that embed an obfuscated PowerShell one-liner using a custom character-skip cipher (Beting) to decode strings at runtime. Linguistic fingerprint: predominantly Danish/Nordic variable names. Downloads a Base64-wrapped second stage from a hardcoded HTTPS URL and reflectively executes a payload extracted from a hardcoded offset within the downloaded blob.
Capabilities
- batch-script-powershell-stager
- character-skip-cipher-string-deobfuscation
- https-download-tls12-enforced
- base64-wrapped-blob-payload-extraction
- hardcoded-offset-payload-carving
- iex-reflective-execution
- service-termination-prior-to-staging
- user-agent-masquerade-fabricated-browser-version
Build / RE
- Language: DOS batch file (
cmd.exe) wrapping inline PowerShell - Obfuscation: Custom
Betingcipher — real characters sit at every 4th position starting from index 3 inside noise-padded string literals. Trivially reversible with a regex stride extractor. Dead-code assignments ($mari=Compare-Object stormest beau) pad the decoder loop to slow naive regex approaches. ^[/intel/analyses/402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177.html] - Anti-analysis: No VM/debug detection; relies on being a plain text file that sandboxes may skip. The noise-padding defeats naive string-matching but not structural analysis. ^[/intel/analyses/402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177.html]
- Code quality: Low — hardcoded offsets, hardcoded URL, single C2 with no failover, fabricated User-Agent string with a non-existent Firefox version number. Suggests commodity-tier tooling. ^[/intel/analyses/402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177.html]
- Linguistic fingerprint: Variable names are Danish or Nordic (
driftssik,udglatte,smsyninger,thalassom187,tolerer,totalo,duktili). This is a strong attribution clue and distinguishes the family from Spanish/Portuguese or English-named alternatives. ^[/intel/analyses/402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177.html]
Deploy / ATT&CK
| Tactic | Technique | Evidence |
|---|---|---|
| Execution | T1059.003 (Windows Command Shell) | Batch script launches PowerShell |
| Execution | T1059.001 (PowerShell) | Inline -windowstyle hidden with IEX |
| Command and Control | T1105 (Ingress Tool Transfer) | Net.WebClient.DownloadFile over HTTPS |
| Defense Evasion | T1620 (Reflective Code Loading) | IEX executes payload without disk write |
| Defense Evasion | T1027 (Obfuscated Files or Information) | Beting character-skip cipher |
| Impact | T1070.004 (File Deletion) | spsv ichoglanop — stops prior service |
Sibling Analyses
402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177— First observed sibling:123.bat, Italian C2libreriaduepuntozero.it, Firefox 143.0 masquerade, Danish variable names, payload offset 428386 / length 22190. ^[/intel/analyses/402879ff4b368a1dc489d8572137305c84b1983d9539d374f45f815bfa7c1177.html]
Related
- unclassified-batch-powershell-dropper — Different family: Spanish/Portuguese batch→PowerShell dropper using SET/GOTO variable expansion and paste-site failover. Same staging concept, different obfuscation scheme.
- batch-powershell-variable-expansion-obfuscation — Technique page for the SET/GOTO family.
- character-skip-cipher-powershell-obfuscation — Technique page for the
Betingcipher observed in this family. - powershell-cradle-downloader — Generic PowerShell download cradle pattern.