Can Someone Help Me Understand This Suspicious Batch Script I Found?

0
11
Asked By CuriousCat88 On

I found a suspicious batch script named Moviex.bat injected on one of my isolated machines, which doesn't have any important data on it. I'm just curious about what it does. I haven't run it and I don't take any responsibility for anyone else who might try running it. Below is the complete script for reference.

5 Answers

Answered By DecodingNinja On

You could throw the random text into a base64 decoder tool for easier decoding. Just a warning though; you’ll want to assume that machine is compromised and should be wiped afterwards.

Answered By MalwareHunterZ On

Just to add on, it appears this script downloads a fake JPEG from a server that actually contains malicious code. It could end up injecting this code into heavy CPU processes running on your machine. Proceed with caution!

Answered By TechGuru42 On

This looks like a malware loader. I wouldn't run it outside of a quarantined environment, just to be safe.

Answered By Polaris96 On

If you ever give it to a paid version of ChatGPT, it might help decode this for you. But again, tread carefully.

Answered By ScriptDecoder99 On

The script sets a bunch of environment variables, many of which are parts of a base64 encoded string. A quick tip: take everything after the equals sign in each 'SET' command related to $encodedData, replace 'd@' with 'r', and decode it. You should be able to reveal the original script that way, but it's likely to still be malicious.

Related Questions

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.