Analyzing PowerShell Payloads Part 5

Example 5: PowerShell payload containing shellcode contained within obfuscated hexadecimal data

Cyber Chef Recipe

Regular_expression('User defined','[0-9a-zA-Z+/=]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Regular_expression('User defined','[0-9a-z\\<\\,]{30,}',true,true,false,false,false,false,'List matches')
Find_/_Replace({'option':'Regex','string':'<'},'BxDx',true,false,true,false)
Find_/_Replace({'option':'Regex','string':'BxD'},'0',true,false,true,false)
From_Hex('Auto')

--

John Dwyer
--

Disclaimer: Samples shown in the video were pulled from open source intel locations and we don't recommend accessing the associated IPs or domains.