Malware Analysis Batch Worm - Magonet.b

[SkyboundSteven]

Note to moderators: Please move this post to applicable location.
Or if it has right prefix and is in right caterory, please remove this line.
Thank you, and have a good day.​

This is a detailed analysis for a Batch worm virus called Magonet.b (Magonet.a has reproduction failure).
It is a proof-of-concept script, but due to the nature of Batch script, it can be easily modified by anyone to include a malicious payload, so it might be good to know how it spreads and how it functions.

1. In order to infect the system, the worm arrives in either packed form or raw form, sometimes obfusticated. It might have a promising name, or it might arrive in a bundled form with other legitimate programs (such as Generic Minecraft Server Starters, which also uses Batch)
2. The worm waits for the user to execute the script.
3. Because it is a proof-of-concept worm, it displays message and drops a text file telling the user how to disinfect system.
4. The worm copies itself to the C:\ and starts copying itself to drives D:\ to Z:\.
5. If the worm happens to land on a removable device, it waits for the user to start the script, and the aforementioned routine starts again.