Suspicious Batch File AV Evasion And Execution

Tim Peck@timpeck

•updated Sep 22, 2025•0•98

Detects a Windows command shell executing a batch file that subsequently spawns processes for system discovery (often for AV checking) and then either executes a potential payload or performs network reconnaissance. This behavior is consistent with the initial stages of the BlockBlasters malware campaign.