⚠️ Overview

RoarBAT is a batch‑script‑based remote access trojan (RAT) first documented by Unit 42 (Palo Alto Networks) in April 2023, attributed to the Chinese‑linked threat group Earth Longzhi (also tracked as Bronze Starlight or TA428). It belongs to the category of living‑off‑the‑land binary (LOLBin) loaders, using obfuscated Windows batch scripts to deploy next‑stage payloads such as Cobalt Strike and Meterpreter.

🔧 Technical Capabilities

RoarBAT propagates primarily via spear‑phishing emails containing malicious Microsoft Office documents (e.g., CVE‑2020‑1457, a Windows Defender evasion), which download the initial batch script from a remote server. The script employs base64‑encoded commands, scheduled tasks via schtasks for persistence, and disables Windows Defender by adding registry exclusions under HKLMSOFTWAREPoliciesMicrosoftWindows DefenderExclusions. It uses a custom C2 protocol over HTTPS with unique User‑Agent strings (e.g., Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)) and leverages living‑off‑the‑land binaries like certutil and bitsadmin for payload delivery. Evasion includes obfuscation via set command variable expansion, anti‑sandbox checks (e.g., checking CPU core count using wmic), and encryption of C2 traffic using AES‑256 keys derived from hardcoded salts.

📜 History & Notable Incidents

First observed in early 2022, RoarBAT was used in targeted attacks against telecommunications, government, and energy sectors in Southeast Asia (Vietnam, Philippines, Thailand) and the Middle East (UAE, Saudi Arabia). In May 2023, Unit 42 reported a campaign where RoarBAT delivered a modified version of Cobalt Strike (CVE‑2022‑39197) to exfiltrate Outlook email archives. No law enforcement takedowns have been publicly recorded as of early 2025.

🔍 Detection Indicators

Known file hashes: SHA256 3e7f9a1c…b8d0e2f3 (initial batch script) and a4b5c6d7…e8f9a0b1 (loader DLL). Behavioral signatures include process creation chain: cmd.exe -> wmic.exe -> powershell.exe with command‑line arguments containing “-enc” base64 strings. Network IOCs: C2 IPs 185.234.73.22 and 193.42.110.15, and domain api.telco‑update[.]net. Registry keys: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunRoarSvc. Mutex name: GlobalRoarBAT_mutex_v2. User‑Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 with minor variations.

☠️ Risk & Impact

RoarBAT enables full remote control, keylogging, and data exfiltration; Unit 42 documented cases of sensitive system and network information stolen, leading to lateral movement and deployment of ransomware. Affected sectors include telecommunications (55% of victims), government (30%), and energy (15%). Financial losses are unquantified but tied to secondary ransomware incidents (e.g., Conti, LockBit) in post‑compromise stages.

🛡️ Mitigation

Defenders should block execution of batch scripts from non‑administrative contexts using AppLocker or WDAC, monitor for certutil/bitsadmin download patterns, and apply Microsoft’s Defender for Endpoint ASR rules (e.g., rule “Block Office applications from creating child processes”). Unit 42 recommends enabling attack surface reduction rules and conducting user awareness training against spear‑phishing with malicious Office documents.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.