Jlaive

Jlaive is a malware that began circulating in 2022, primarily known for its obfuscation algorithm powered by the BatCloak engine. The malware was designed to evade antivirus software by converting executables into undetectable batch files. The creator, identified as ch2sh, made significant contributions to Fully Undetectable (FUD) technologies, with Jlaive being an open-source toolkit. However, even though the Jlaive code repository appears abandoned, researchers have discovered that BatCloak remains active as a standalone repository, with threat actors behind Jlaive contributing to numerous iterations and adaptations of the engine. SeroXen, a modified version of Quasar RAT, adopted the loader builder Jlaive and BatCloak obfuscation engine to generate a FUD .bat loader. This modification included a rootkit among other changes. While many repositories containing modified or cloned versions of Jlaive continue to be removed from code hosting sites like GitHub and GitLab, threat actors persist in uploading the code. In some cases, development teams have ported the code to other languages such as Rust. BatCloak's functionality is specifically tied to the instructions "LineObfuscation.cs and FileObfuscation.cs" used in the Jlaive crimeware. Researchers have found that the BatCloak engine was part of the Jlaive FUD builder and is now repurposed. The BatCloak engine has also been utilized in the ScrubCrypt malware toolkit, which unlike Jlaive, is closed-source. Despite the abandonment of Jlaive's original repository, the continued use and adaptation of its core BatCloak engine highlight the ongoing threat posed by this sophisticated obfuscation technology.