Modiloader From Obfuscated Batch File, (Mon, Dec 23rd)

Technical analysis of an email-delivered malicious archive (Albertsons_payment.GZ) that contains an obfuscated Windows batch loader which uses string slicing and LOLBIN abuse (extrac32, certutil) to decode and drop a Delphi-based Modiloader (spoolsv.com, SHA256: baa12b649fddd77ef62ecd2b3169fab9bb5fbe78404175485f9a7fb48dc4456d) that attempted to fetch a secondary stage from https://swamfoxinnc.com/233_Svcrhpjadgy; the report includes observed behaviors, extraction/deobfuscation details, and IOCs.