Dropper

3048.ps1

Author: Moise Medici
Updated: 13 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Command Execution via Powershell Cmd Bash In-Process Shellcode Execution Command and Control C2 Communication Dropping Secondary Payloads
Tags: ps1 shellcode

Indicators Of Compromise

Network

185.243.115.227:443 C2, contacted over HTTPS by the shellcode
https://185.243.115.227/DZohRccBJxOZkZiTxPECkwYxaxM0b8wUJgwVC2tXrdsd4M3LVQ9Emi6d036V0wErFx26Vn-XvXE_YFtCGZAZo40gGUa0qgQ790MQ-_3rymr9zE4ZsNheCfZzx3fiOoa8wuNEitoEVT5nSH1O9GAf7bJZabC34Q2QCuhU_v next stage download

Hashes · SHA-256

14a42d6418b38103a7fdccc5b1d37e4fb0efcad2f847c9996465c5fdc78632c2 3048.ps1
7a423251babfadb8eefdcdfbaaf505bb3efdf6c82eadad70e60bde0d66a0f0b4 stage2.ps1
bb604d0aa74a0f8e045c2d7ee00bb4dd6a3f2d2892e8df4819f62bbe2183e8e6 stage3.bin