{
	"id": "fd4b0fd4-41d4-466c-acb5-aaee0f80f4ab",
	"created_at": "2026-04-06T00:13:07.124268Z",
	"updated_at": "2026-04-10T03:21:14.280196Z",
	"deleted_at": null,
	"sha1_hash": "ec3b685b8bf4e499b4e2cafc36873df5e7eb0381",
	"title": "FakeBat Continues Signed MSIX App Package Abuse",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2280424,
	"plain_text": "FakeBat Continues Signed MSIX App Package Abuse\r\nBy eSentire Threat Response Unit (TRU)\r\nArchived: 2026-04-05 16:09:14 UTC\r\nAdversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters\r\nand Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.\r\nWe have discovered some of the most dangerous threats and nation state attacks in our space – including the\r\nKaseya MSP breach and the more_eggs malware.\r\nOur Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced\r\nThreat Analytics driven by our Threat Response Unit – the TRU team.\r\nIn TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We\r\noutline how we responded to the confirmed threat and what recommendations we have going forward.\r\nHere’s the latest from our TRU Team…\r\nThis blog was updated in September 2023 based on research from TRU that identifies this as FakeBat. This blog\r\noriginally identified this threat as FakeBat.\r\nWhat did we find?\r\nIn July, the eSentire Threat Response Unit (TRU) identified multiple FakeBat cases investigated by our SOC\r\nteam. In these cases, the victims fell for suspected malicious advertisements impersonating Zoom and\r\nTradingView after performing web searches for these products.\r\nThe victims had then downloaded malicious MSIX installer files (such as Zoom-x64.msix) which attempted to\r\ninfect their systems with Redline Stealer and SectopRAT. These were the first such observations in our telemetry\r\nsince May 2023. Our analysis here will focus on discovering imposter websites and MSIX samples currently\r\nbeing used in FakeBat campaigns.\r\nFakeBat Imposter Sites Registered on June - July 2023\r\nTRU identified several suspected FakeBat payload sites hosted on IP 80.68.159.10 registered in June and July\r\n2023:\r\ntradling-view[.]com\r\nget-adobe[.]net\r\nzooml-us[.]com\r\nopen-aii[.]com\r\nmldiourney[.]com\r\nstore-steampowered[.]net\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 1 of 11\n\nmlcrosoft-online[.]net\r\nqul-cken[.]com\r\nThe domain names suggest an array of brands are impersonated in these attacks, including Microsoft, Zoom,\r\nAdobe, Steam, OpenAI, etc. (a more complete list can be found at the end of this blog). These brands have been\r\nused historically in previous FakeBat attacks, and landing pages comprise of an imposter download page for these\r\nproducts.\r\nWhen visited manually, these sites present empty content or 403 HTTP errors, and successful recreation of\r\ninfection chains has been minimal thus far. This may suggest operators may have improved the cloaking of these\r\nsites to evade discovery by researchers and scanners.\r\nWe did identify one successfully rendered page for Steam (store-steampowered[.]net) submitted to Urlscan.io on\r\nJune 6, which shows an imposter page for the gaming service. The website was registered the same day and\r\nserved a legitimate Steam binary at the time.\r\nFigure 1 Imposter page for Steam, retrieved from Urlscan.io.\r\nWe assess this site likely served Steam-x64.msix (md5: c37aee1ebad9b0f7bd2e7755a3133d0e) in mid-July 2023\r\nshown in Figure 2 below.\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 2 of 11\n\nFigure 2 MSIX app launch. File is signed and asks for elevated privileges.\r\nFakeBat Continues to Abuse Signed MSIX Packages\r\nAs we covered in our May blog, MSIX files are a relatively new installer format designed for Windows 10 and\r\nabove. It requires the package contents to be signed; a barrier intended to limit abuse by threat actors.\r\nUnfortunately, these code signing certificates do find their way into threat actor hands and can be acquired on\r\nunderground forums for a fee.\r\nIn a February post on XSS forums, a suspected FakeBat operator vouched for a code signing service offered by\r\nanother forum member by providing a screenshot of their previous transaction with this member:\r\nFigure 3 Suspected FakeBat operator's image posted to XSS in February 2023. The image purports\r\nto be the purchase of a code signing certificate from another forum member.\r\nIt's highly probable that FakeBat operators are purchasing the required code signing certificates used in their\r\ncampaigns from other threat actors.\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 3 of 11\n\nThe latest MSIX app packages reviewed by TRU contained content signed by IMPERIOUS TECHNOLOGIES\r\nLIMITED, a private limited company based out of the UK.\r\nFigure 4 Steam-x64.msix digital signature.\r\nThe AppManifest shows the package was created with Advanced Installer version 20.2 configured with Russian-language settings.\r\nWhen launched, the package executes with elevated privileges then executes an embedded PowerShell script then\r\ndrops and executes a legitimate copy of the Steam installer as a decoy. The PowerShell script\r\n(“NEW_mormons_v1.ps1”, MD5: d87bc0bcfa1976ffa6a165545fb7ca62) contains a similar structure to prior\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 4 of 11\n\nsamples, with some minor updates. It downloads Redline Stealer binary disguised as a jpg file (“czx.jpg”, MD5:\r\nd5a1d54158e110a8d9b0eea06d37e26f) from hxxps://tatmacerasi[.]com and SectopRAT/ArechClient (“zhelp.exe”,\r\nMD5: 3AC860860707BAAF32469FA7CC7C0192) from hxxps://fullpower682[.]store.\r\nAdditional details on the PowerShell script can be seen in the annotated image below.\r\nFigure 5 PowerShell script \"NEW_mormons_v1.ps1\" with annotations.\r\nSimilarities with prior FakeBat samples include:\r\nMSIX created with Advanced Installer v. 20.2 with Russian language option\r\nDecoy executable\r\nPowerShell execution via signed MSIX\r\nPowerShell behavior:\r\nOne or more execution delays via sleep command\r\nConnect to C2 to signal “start”\r\nDownload payload from URL ending in .jpg\r\nConnect to C2 to signal “install”\r\nLoad payload assembly using PowerShell\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 5 of 11\n\nA May PowerShell sample for comparison:\r\nFigure 6 May 2023 PowerShell sample. See https://www.esentire.com/blog/fakebat-impersonates-midjourney-chatgpt-in-drive-by-cyberattacks\r\nPayloads\r\nSectopRAT is downloaded as an encrypted RAR archive and decrypted using 7zip (also downloaded). The\r\nSectopRAT payload (MD5: DD50DE3ACC26293986F40EB04F0F1A99) is written to AppData\\Local\\Temp\\ and\r\ninjected into MsBuild.exe. It retrieves its C2 configuration from Pastebin and connects to 194.26.135[.]180 for\r\ncommand and control.\r\nFigure 7 SectopRAT seen in debugging tool showing the ScanDetails class and various properties\r\nrelated to information collected from the target system.\r\nRedline Stealer is loaded as assembly by PowerShell, with the resulting payload (MD5:\r\nD5A1D54158E110A8D9B0EEA06D37E26F) connecting to 194.26.135[.]119 port 12432 for command-and-control.\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 6 of 11\n\nFigure 8 Snippet of Redline Stealer network traffic.\r\nFor a complete analysis of another Redline sample, read our Redline Stealer malware analysis.\r\nHow did we find it?\r\nMDR for Endpoint identified MSIX activity and blocked subsequent behavior.\r\nWhat did we do?\r\nOur team of 24/7 SOC Cyber Analysts isolated the host and alerted the customer while an investigation\r\ntook place before remediating the threat.\r\nWhat can you learn from this TRU positive?\r\nImposter sites distributed via ad platforms (such as Google Ads) have diminished since the start of 2023\r\nbut remain a concern. It’s probable these ad services have improved their processes to tamp down on abuse,\r\nbut it’s also apparent that threats like FakeBat have improved their tradecraft to circumvent these controls.\r\nTargeted brands include products and services commonly found in business environments. Infected,\r\ndomain-joined systems offer more value for data theft and follow-on intrusion attacks (e.g. ransomware).\r\nBoth Redline and SectopRAT provide a foundation to monetize infected assets and exploit them for\r\nfurther intrusion actions.\r\nSigned code is a barrier that can be circumvented. Code signing certificate services can be acquired from\r\ncriminal forums for a fee; FakeBat has likely used these services to sign MSIX packages.\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 7 of 11\n\nSuspicious MSIX execution can be identified by monitoring for PowerShell (or other script formats)\r\nexecution under aistubx64.exe.\r\nFor example: svchost.exe -\u003e aistubx64.exe -\u003e PowerShell.exe\r\nRecommendations from our Threat Response Unit (TRU):\r\nProtect endpoints against malware by:\r\nEnsuring antivirus signatures are up-to-date.\r\nUsing a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) tool to detect and\r\ncontain threats.\r\nRaise awareness of malware masquerading as legitimate applications, and include in your Phishing and\r\nSecurity Awareness Training (PSAT) program. An effective PSAT program emphasizes building cyber\r\nresilience by increasing risk awareness, rather than trying to turn everyone into security experts.\r\nWindows Defender Application Control provides options for managing packaged apps (MSIX).\r\nIndicators of Compromise\r\nIndicator Note\r\ntradling-view[.]com\r\nSuspected FakeBat Imposter Sites\r\nwww[.]adlobe[.]net\r\nwww[.]get-adobe[.]net\r\nadlobe[.]net\r\nget-adobe[.]net\r\nwww[.]drlve-googie[.]com\r\nwww[.]zooml-us[.]com\r\ndrlve-googie[.]com\r\nusblank[.]net\r\nzooml-us[.]com\r\nopen-aii[.]com\r\nso-lfi[.]com\r\nvirtuaibox[.]net\r\nmldiourney[.]com\r\nblt-warden[.]com\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 8 of 11\n\nstore-steampowered[.]net\r\nmlcrosoft-online[.]net\r\nqul-cken[.]com\r\nfileziila-project[.]com\r\nwww.whcts-app[.]com\r\nwww.notcpad-pius-pius[.]org\r\n623start[.]site FakeBat C2 (confirmed)\r\ncdn-prok[.]site\r\nFakeBat C2 (suspected)\r\ncdn-dwnld[.]ru\r\nstart-up-plus[.]site\r\nnewvision623[.]site\r\ncdn-dwnld[.]site\r\ncdn-dwnld[.]store\r\ntatmacerasi[.]com Secondary Payload Host\r\nfullpower682[.]store Secondary Payload Host\r\n194.26.135[.]180 SectopRAT C2\r\n194.26.135[.]119 Redline C2\r\nC37AEE1EBAD9B0F7BD2E7755A3133D0E Steam-x64.msix\r\nD87BC0BCFA1976FFA6A165545FB7CA62 NEW_mormons_v1.ps1\r\nD5A1D54158E110A8D9B0EEA06D37E26F czx.jpg\r\n3AC860860707BAAF32469FA7CC7C0192 zhelp.exe\r\nDD50DE3ACC26293986F40EB04F0F1A99 SectopRAT\r\nD5A1D54158E110A8D9B0EEA06D37E26F Redline\r\nTo learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next\r\nLevel MDR, connect with an eSentire Security Specialist now.\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 9 of 11\n\nGET STARTED\r\nABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU)\r\nThe eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your\r\norganization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7\r\nSecurity Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and\r\nworks as an extension of your security team to continuously improve our Managed Detection and Response\r\nservice. By providing complete visibility across your attack surface and performing global threat sweeps and\r\nproactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending\r\nyour organization against known and unknown threats.\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 10 of 11\n\nSource: https://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nhttps://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse\r\nPage 11 of 11\n\nWhen launched, drops and executes the package a legitimate executes with elevated copy of the privileges Steam installer then executes as a decoy. an embedded The PowerShell script PowerShell script then\n(“NEW_mormons_v1.ps1”, MD5: d87bc0bcfa1976ffa6a165545fb7ca62)   contains a similar structure to prior\n   Page 4 of 11",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse"
	],
	"report_names": [
		"batloader-continues-signed-msix-app-package-abuse"
	],
	"threat_actors": [],
	"ts_created_at": 1775434387,
	"ts_updated_at": 1775791274,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ec3b685b8bf4e499b4e2cafc36873df5e7eb0381.pdf",
		"text": "https://archive.orkl.eu/ec3b685b8bf4e499b4e2cafc36873df5e7eb0381.txt",
		"img": "https://archive.orkl.eu/ec3b685b8bf4e499b4e2cafc36873df5e7eb0381.jpg"
	}
}