> Family · Unclassified Destructive Batch Script Family_

~/packetpursuit $ cat /intel/families/unclassified-destructive-batch.md

typeentityfamilyunclassified-destructive-batchconfidencelowcreated2026-06-14updated2026-06-14scriptimpactwipersmasqueradingdefense-evasion

Unclassified Destructive Batch Script Family

Windows batch-script destructive payloads that masquerade as benign utilities (DDoS tools, WiFi drainers, system optimizers) to trick victims into executing destructive cmd.exe commands. No obfuscation, no C2, no staging — pure impact via built-in Windows CLI.

Capabilities

  • destructive-batch-system32-recursive-deletion
  • masquerade-benign-tool-title-prompt
  • takeown-privilege-escalation-via-acl-seizure
  • cmd-loop-infinite-post-destruction

Build / RE

  • Language: Plain DOS batch (cmd.exe interpreter). No packer, no obfuscation, no encoding. ^[sample e844c4cb/file.txt]
  • Code quality: Extremely low — bare commands with amateur masquerade strings (magenta ddos (dos), wifi drainage 3.3132%). ^[sample e844c4cb/strings.txt:2,36]
  • Anti-analysis: None. Relies on being a trivial text file that sandboxes may skip, and on social engineering to get the victim to run it.
  • Anti-forensics: None. Commands are logged in Windows Event Log (Security / System) and command-history forensics.

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 (Windows Command Shell) Plaintext .bat executed via cmd.exe. ^[sample e844c4cb/file.txt]
Impact T1485 (Data Destruction) rd /s /q c:\windows\system32 and del /s /q c:\windows\system32\*.* ^[sample e844c4cb/strings.txt:24,25]
Defense Evasion T1036.005 (Match Legitimate Name or Location) Masquerades as a DDoS tool with IP-input prompt and fake loading screen. ^[sample e844c4cb/strings.txt:2,8]
Defense Evasion T1562.001 (Impair Defenses) takeown /f c:\windows\system32 /a /r /d y seizes file ownership to bypass ACL restrictions before deletion. ^[sample e844c4cb/strings.txt:22]

Infrastructure

None. These scripts are entirely self-contained and offline.

Locale / Attribution

  • Amateur / script-kiddie tooling. No infrastructure, no reuse patterns, no professional build pipeline.
  • The fucker.bat filename and contradictory post-destruction messages (ddos failed... / dos attempt success) read like prankware or trollware rather than state-sponsored or crimeware.
  • No code-family overlap with other batch-script clusters in the corpus (e.g. anydesk-batch-dropper uses commodity tool staging; unclassified-batch-powershell-dropper uses SET/GOTO variable expansion and PowerShell reflective loading).

Sibling Analyses

  • e844c4cb88973679194026a28890f884bfe5d553766a83e96541d4cd6b6e9acc — First observed sample (fucker.bat, 982 bytes). Title masquerade as magenta ddos (dos). ^[/intel/analyses/e844c4cb88973679194026a28890f884bfe5d553766a83e96541d4cd6b6e9acc.html]

Related

  • ransomware — Concept page for encryption-based destruction. This family is destructive but does not encrypt (pure deletion).
  • chacha8 — A true file-encryptor/wiper family observed in this corpus, contrasted with this batch-script approach.
  • anydesk-batch-dropper — A batch-script family that stages legitimate tools rather than destroying the system.