PowerShell CRYPTOSTEALER through DNS
Source: YouTube · John Hammond · published May 9, 2023 · 24:29
The video analyzes three malicious PowerShell files discovered in C:\Windows\System32 that automatically execute at system startup 0:00. The scripts use obfuscated PowerShell aliases and script blocks to pull encoded commands from the Windows registry and execute them via Invoke-Command 2:50.
Key Takeaways:
• The malware uses PowerShell aliases like ICM (Invoke-Command) and GP (Get-ItemProperty) to hide its functionality 3:00
• Base64-encoded values stored in the Windows registry contain second-stage PowerShell code that gets executed 8:45
• The malware implements a domain generation algorithm (DGA) to connect to various domains and retrieve commands through DNS text records 12:20
• The final payload is a crypto/info stealer that targets cryptocurrency wallet extensions in browsers like Chrome, Brave, and Edge 21:35
This analysis demonstrates how PowerShell malware can use registry persistence, DNS communication, and multi-stage execution to evade detection while stealing sensitive cryptocurrency information 22:10.
Sources:
- 0:00 Introduction to the malicious PowerShell files in System32
- 2:50 Explanation of PowerShell aliases used for obfuscation
- 8:45 Base64 decoding of registry values to reveal second-stage code
- 12:20 Domain generation algorithm for DNS communication
- 21:35 Identification as crypto wallet stealer target
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I have three files here that were part of a recent investigation all of these were staged as scheduled tasks or Auto runs or startup entries it would automatically run when your computer turns on or a user logs in it's meant to be persistence for a threat actor hacker adversary whatever you might like here now all of these seemingly are placed in C Windows system 32. I've just created them as files here so we can poke and play with them but on the file system they were inside of the root of the operating system right so it's interesting because that leads me to think oh maybe they were already admin they had right access and permissions actually stage files inside of this privilege directory and obviously all of them end with a DOT PS1 file file extension and they are Powershell scripts so…