SHA1 hash:
- d2106c8dfd0c681c27483a21cc72d746b2e5c18c (scan26_08_2025.bat)
Description
A malicious batch file for the Windows command-line interpreter. It downloads the PowerShell backdoor PowerShell.BackDoor.109 into the target system.
Operating routine
BAT.DownLoader.1138 downloads the PowerShell script dis.ps1 (PowerShell.BackDoor.109) from the C2 server hxxp[:]//168[.]100.10[.]73, places it into the directory %temp%, and then runs it.
BAT.DownLoader.1138’s functionality
When launched, PowerShell.BackDoor.109 creates a directory %temp%/downloads.
Next, it uploads information about the computer to the C2 server at hxxp[:]//168[.]100.10[.]73:5000/register. It then connects to the C2 server at hxxp[:]//168[.]100.10[.]73:5000/get-commands?agent=<computername>, awaiting commands from it.
The backdoor can receive the following commands:
- upload — to download a specified file from hxxp[:]//168[.]100.10[.]73:5000/uploads/<filename>;
- run — to run the file at a specified path.
PowerShell.BackDoor.109’s functionality
