ObscureBat is a new malware campaign employing social engineering tactics to deliver the open source r77 rootkit, enabling threat actors to establish persistence and evade detection on compromised Windows systems. The campaign targets English-speaking individuals, particularly in the United States, Canada, Germany, and the United Kingdom. It uses obfuscated batch scripts and PowerShell commands to deploy the rootkit, focusing on stealth and evasion techniques.
The ObscureBat attack begins with an obfuscated Windows batch script that executes PowerShell commands to initiate a multi-stage deployment of the r77 rootkit. The initial infection vector involves luring users into executing malicious batch scripts through fake CAPTCHA verification pages or by disguising the malware as legitimate software downloads (e.g., Tor Browser, VoIP software). Once executed, the script drops additional scripts, modifies the Windows Registry, and sets up scheduled tasks for persistence. The malware employs techniques such as control-flow obfuscation, string encryption, AMSI patching and registry modifications to evade detection. Ultimately, it installs both system-mode and user-mode rootkits (ACPIx86.sys and r77, respectively) to hide files, processes, and registry keys. It also monitors the clipboard and command history, likely for data exfiltration.