Hostile 100% javascript Download

jspacket 0.1.2

Embedded PE, credential dumping, lateral movement

“TypeScript port of Impacket — 52 tools for Active Directory and network protocol pentesting”

HTTP NTLM authentication is relayed to SMBPowerShell hidden bypass encoded command

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.