Batloader or FakeBat? Unraveling Competing MaaS Operations
summary
BatLoader and FakeBat (aka EugeneLoader) deliver MSIX signed packages via Google search ads that use tracking templates and cloakers to hide malicious landing pages; attackers buy code‑signing certs ($3k–$6k) and app accounts, pay a $3,000 entry fee, and host C2 on REG.RU and similar hosts. Initial beacon strings include ?server_name=MSI and RSA‑wrapped UTM_CONTENT; loaders use PyArmor obfuscation or PowerShell symbolic obfuscation, decrypt with OpenSSL or PrivGuard, drop RedLine/Lumma/SectopRAT, and revoking certs forces multi‑day outages.
AI-written summary · about
chapters (9)
- 0:00Modern malware trends
- 2:03The anatomy of malvertising
- 8:11Underground infrastructure
- 14:31Introduction to BatLoader
- 20:09Competing service: FakeBat
- 26:02Technical comparison and detection
- 30:38Hunting for indicators
- 36:14Defensive strategies
- 41:15Q&A session
related talks
30mMalicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
30mReversing Mobile Malware
37mMoustachedBouncer: AitM-Powered Surveillance via Belarus ISPs
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
26mCertificate Bypass: Hiding and Executing Malware from a Digitally Signed Executable