MALWARE FAMILY

BATLOADER

Internal ID: win.bat_loader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to PCrisk, BATLOADER is part of the infection chain where it is used to perform the initial compromise. This malware is used to execute payloads like Ursnif. Our team has discovered BATLOADER after executing installers for legitimate software (such as Zoom, TeamViewer Visual Studio) bundled with this malware. We have found those installers on compromised websites.

Threat Analysis

BATLOADER is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

→https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle

→https://intel471.com/blog/malvertising-surges-to-distribute-malware

→https://medium.com/walmartglobaltech/revisiting-batloader-c2-structure-52f46ff9893a

→https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489

→https://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse

→https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif

→https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader

→https://www.kroll.com/en/insights/publications/cyber/hive-ransomware-technical-analysis-initial-access-discovery

→https://www.mandiant.com/resources/seo-poisoning-batloader-atera

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.bat_loader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BATLOADER