Executive Summary
Analysis of a malicious batch script reveals a sophisticated infection chain mostly attributed to the RareWolf threat actor. The script initiates a payload download using curl or PowerShell, bypassing TLS certificate validation to deliver a password-protected archive. Once extracted, the malware installs AnyDesk silently and attempts to configure a hard-coded password for unattended remote access, effectively establishing a persistent foothold for the adversary.
The attack also includes data exfiltration capabilities. The script archives AnyDesk configuration data from the %ProgramData% directory using WinRAR or 7-Zip with hard-coded passwords and utilizes the Blat utility to email these archives to an attacker-controlled SMTP server. Persistence is further reinforced through a scheduled task named 'Microsoft apdate' designed to launch a suspicious executable at user logon.
This campaign highlights the continued risk of 'living off the land' techniques, where legitimate tools like AnyDesk and Blat are weaponized for unauthorized access and data theft. The presence of hard-coded credentials and automated cleanup routines indicates a high level of preparation by the RareWolf actor.