Dropper

3048.ps1

Author: Moise Medici
Updated: 13 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Languages: PowerShell x64 Assembly (shellcode)
MITRE: T1059.001 (Command and Scripting Interpreter: PowerShell) T1106 (Native API) T1027.007 (Obfuscated Files or Information: Dynamic API Resolution) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1027.015 (Obfuscated Files or Information: Compression) T1140 (Deobfuscate/Decode Files or Information) T1564.003 (Hide Artifacts: Hidden Window) T1620 (Reflective Code Loading) T1071.001 (Application Layer Protocol: Web Protocols) T1105 (Ingress Tool Transfer)

Indicators Of Compromise

Network

185.243.115.227:443

C2, contacted over HTTPS by the shellcode

https://185.243.115.227/DZohRccBJxOZkZiTxPECkwYxaxM0b8wUJgwVC2tXrdsd4M3LVQ9Emi6d036V0wErFx26Vn-XvXE_YFtCGZAZo40gGUa0qgQ790MQ-_3rymr9zE4ZsNheCfZzx3fiOoa8wuNEitoEVT5nSH1O9GAf7bJZabC34Q2QCuhU_v

next stage download

Hashes · SHA-256

14a42d6418b38103a7fdccc5b1d37e4fb0efcad2f847c9996465c5fdc78632c2

3048.ps1

7a423251babfadb8eefdcdfbaaf505bb3efdf6c82eadad70e60bde0d66a0f0b4

stage2.ps1

bb604d0aa74a0f8e045c2d7ee00bb4dd6a3f2d2892e8df4819f62bbe2183e8e6

stage3.bin