A recent threat hunting operation uncovered a sophisticated PowerShell script, y1.ps1, used as a shellcode loader operating in memory to evade detection. This malware leverages global cloud infrastructure, obfuscation techniques, and Cobalt Strike infrastructure to maintain persistence and command execution. #PowerShell #CobaltStrike
Keypoints
- The malicious script dynamically resolves Windows API functions and decrypts embedded shellcode in memory.
- It communicates with a second-stage C2 server hosted on Baidu Cloud, using API hashing and forged User-Agent strings for stealth.
- The final payload connects to a Cobalt Strike Beacon located in Russia, indicating its use in post-exploitation activities.
- The malware employs reflective DLL injection and cloud infrastructure across multiple countries to evade detection.
- Mitigation strategies include strict PowerShell policies, endpoint detection, and blocking known malicious IPs and domains.
Read More: https://gbhackers.com/powershell-loaders-use-in-memory-execution/