New OBSCURE#BAT Manipulates System Processes & Registry Entries To Evade Detection

A sophisticated malware campaign, tracked as OBSCURE#BAT, has been identified using heavily obfuscated batch scripts to install stealthy rootkits, allowing attackers to maintain persistent access to compromised systems while avoiding detection.

This campaign uses social engineering tactics and deceptive file downloads to trick users into executing malicious code, which then sets off a complex chain of infections resulting in a user-mode rootkit deployment.

The infection begins when unsuspecting victims execute malicious batch files, often disguised as legitimate software installations or fake captcha verification prompts.

Once executed, these files initiate a series of environment variable manipulations and PowerShell commands to deploy next-stage payloads while simultaneously deleting themselves to remove evidence of the initial infection.

Analysts at Securonix have identified that the malware employs multiple obfuscation techniques, including string concatenation and character replacements, to evade detection.

The initial batch files score remarkably low on antivirus detection, with only 0-2 detections on platforms like VirusTotal, despite their malicious nature.

“The PowerShell executed in the next stage performs key tasks,” notes the Securonix report, including anti-analysis checks that verify system hardware to detect forensic environments.

The malware then leverages AES encryption to decrypt and execute encoded payloads directly in memory through reflection techniques, avoiding writing files to disk.

What makes OBSCURE#BAT particularly dangerous is its implementation of the r77 rootkit, which systematically conceals malicious artifacts from standard system tools.

This rootkit hides files, registry entries, and running processes that match a specific pattern (“\$nya-“), making them invisible to Task Manager, Explorer, and command-line tools.

Stealthy Persistence Mechanisms

The malware establishes persistence through multiple avenues, primarily utilizing Windows registry and scheduled tasks.

It stores obfuscated PowerShell scripts in registry locations such as “HKLM\SOFTWARE\OOhhhm” and “HKU\S-1-5-21-…-1001\Environment\onimaiuc” that automatically execute when referenced as environment variables.

The malware creates hidden scheduled tasks named “\$nya-qX6Pb164” configured to run at each user logon with highest available privileges.

Additionally, the malware drops a malicious driver file (ACPIx86.sys) into the system directory and registers it as a legitimate Windows service.

Through Windows registry manipulation, it configures this service to start automatically while simultaneously hiding its presence from registry editors through API hooking techniques.

The OBSCURE#BAT campaign demonstrates sophisticated capabilities for monitoring user activity, with the malware regularly capturing clipboard contents and command history, storing this data in hidden files for later exfiltration.

Securonix researchers recommend maintaining vigilance against social engineering attacks and implementing robust endpoint logging to detect similar threats.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.