Batcloak

BatCloak is a fully undetectable (FUD) malware obfuscation engine that has been used by threat actors to stealthily deliver their malware since September 2022. The BatCloak engine was initially part of an FUD builder named Jlaive, which began circulating in 2022. Although the Jlaive code repository appears to be abandoned, researchers discovered that BatCloak had its own standalone repository, with threat actors behind Jlaive contributing to numerous iterations and adaptations of the BatCloak engine. This engine is known for using heavily obfuscated batch files to deploy various malware families, effectively evading detection by antivirus programs. The inclusion of SeroXen and BatCloak in the arsenal of malicious actors underscores the evolution of FUD obfuscators with a low barrier to entry. In June 2023, Trend Micro researchers detailed how multiple threat actors were using the malware obfuscation engine BatCloak. The first entry of a three-part technical analysis titled "The Dark Evolution: Advanced Malicious Actors Unveil Malware Modification Progression" delved into the evolution of the BatCloak obfuscation engine. The second part, titled "SeroXen Incorporates Latest BatCloak Engine Iteration," discussed the SeroXen malware and its use of the latest iteration of BatCloak to generate an FUD ".bat" loader. BatCloak has been implicated in several campaigns, including one where it was used alongside another malware obfuscation engine called ScrubCrypt to distribute malware through obfuscated batch scripts. An updated version of ScrubCrypt, also known as BatCloak, was reported by the HUMAN Satori Threat Intelligence Team to be delivering the RedLine stealer malware. When targeted users open a specific SVG file, the ECMAScript creates a new blob and uses "window.URL.createObjectURL" to drop the decoded data as a ZIP file. The decompressed file reveals an obfuscated batch file with an embedded payload, presumably created by the BatCloak tool, which distributes malware while effectively evading detection by antivirus programs.