内容仅以原始语言提供
class="post-article">
Loader CMD/PowerShell 自2024年起活跃

CMDPSDropper

CMD to PowerShell dropper. Rgqvr junk-string obfuscation in .cmd script. Contacts vrstem.IO C2. Launches PowerShell minimized. Embedded base64 encrypted payload. String replacement for InvokeExpression construction.

威胁档案
类型 Loader
编程语言CMD/PowerShell
C2协议HTTPS
首次发现2024
目标 Küresel
用途 / 能力
  • Dropper/Downloader

C2服务器 1

地址 端口 协议 状态 操作
vrstem.io
443 HTTPS INACTIVE

⚠ C2 地址仅用于威胁情报和防御目的。未经授权访问这些地址属于违法行为。

研究报告 (1)

Yüksek

CMDPSDropper lods.cmd -- vrstem.IO C2 Indirme Sunucusu, Rgqvr Junk String CMD Obfuskasyon Teknigi, WindowsPowerShell Minimize Gizli Baslama, Buyuk Base64 Sifrelenmis PS Payload Gomulu | Yuksek

CMDPSDropper lods.cmd ZIP 201KB. vrstem.IO C2. Rgqvr junk-string CMD obfuskasyon. WindowsPowerShell minimize gizli baslama. Buyuk base64 sifrelenmis PS payload gomulu.

阅读报告 →