Скачать или смотреть Analyzing PowerShell Payloads - Part 2

In this example, John will be building upon the lessons learned from the first example to extract the tactical information from a PowerShell payload that leverages an XOR function to further obfuscate the C2 data.

--

Cyber Chef Recipe

Regular_expression('User defined','[0-9a-zA-Z+/=]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Regular_expression('User defined','[0-9a-zA-Z+/=]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
Gunzip()
Regular_expression('User defined','[0-9a-zA-Z+/=]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
XOR({'option':'Decimal','string':'35'},'Standard',false)

Sample links: https://www.virustotal.com/gui/file/b...

--

John Dwyer
  / tactikoolsec  

--

Disclaimer: Samples shown in the video were pulled from open source intel locations and we don't recommend accessing the associated IPs or domains.