<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Batch &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/batch/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Wed, 24 May 2023 08:09:37 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Batch &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Obfuscated Batch Scripts in OneNote Document</title>
		<link>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/</link>
					<comments>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 24 May 2023 08:09:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[OneNote]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2696</guid>

					<description><![CDATA[This malicious OneNote document contains two obfuscated batch scripts and we&#8217;ll be using our commercial Simple Batch Emulator package to understand what they do. SHA256: 46149F56028829246628FFAFC58DF81A4B0FF1C87ED6466492E25AD2F23C0A13 We open the first batch script and decode its data to text with the action &#8220;Conversion -> Bytes to text&#8221; (Ctrl+R). This is the batch script and as we &#8230; <a href="https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/" class="more-link">Continue reading<span class="screen-reader-text"> "Obfuscated Batch Scripts in OneNote Document"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2696</post-id>	</item>
		<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>Simple Batch Emulator Package</title>
		<link>https://blog.cerbero.io/simple-batch-emulator-package/</link>
					<comments>https://blog.cerbero.io/simple-batch-emulator-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 09 Feb 2023 12:24:40 +0000</pubDate>
				<category><![CDATA[Engine]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2524</guid>

					<description><![CDATA[To help in the analysis of malware which uses Windows batch scripts we just released a package on Cerbero Store called &#8220;Simple Batch Emulator&#8221;. The name of the package is self-explanatory as it provides a basic emulator for batch scripts. The package is available to all commercial licenses of Cerbero Suite Advanced. The following is &#8230; <a href="https://blog.cerbero.io/simple-batch-emulator-package/" class="more-link">Continue reading<span class="screen-reader-text"> "Simple Batch Emulator Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/simple-batch-emulator-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2524</post-id>	</item>
	</channel>
</rss>
