OXLOADER BATPackageBuilderSetup: PowerShell WebClient Storj Download + RunAs UAC Bypass

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a multi-stage execution pattern involving cmd.exe spawning PowerShell to download files from storjshare.io using System.Net.WebClient, followed by a secondary PowerShell execution using 'Start-Process -Verb RunAs' to trigger a UAC bypass, characteristic of the REF8372 campaign and OXLOADER distribution.