REF8372 OXLOADER batch script spawning PowerShell to download from Storj

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a suspicious pattern consistent with the REF8372 OXLOADER malware delivery, where a batch file (BAT) is executed from the Downloads or Temp directories using cmd.exe, which then spawns PowerShell to download external content from link.storjshare.io.