内容仅以原始语言提供
class="post-article">
Loader C/C++ 自2024年起活跃

PSLoaderDLL

PowerShell loader DLL using WMI (process call create) to launch PowerShell with -executionpolicy bypass -nop -w hidden. HTTP multipart POST with macOS Chrome 102 User-Agent camouflage. Fake Origin/Referer: null.jsbin.com. Creates custom .tpp0/.tpp1 files. WebKit form boundary for file uploads.

威胁档案
类型 Loader
编程语言C/C++
C2协议HTTP
首次发现2024
目标 Kuresel
用途 / 能力
  • Loader/Dropper
尚未发现该家族的 C2 服务器。

研究报告 (1)

Yüksek

PSLoaderDLL 05c72e77 -- WMI PowerShell bypass nop hidden Execution HTTP Multipart POST macOS Chrome User-Agent null.jsbin.com Fake Origin tpp0 tpp1 Custom Extension | Yuksek

PSLoaderDLL 05c72e77 PE32 DLL x86 413KB. WMI process call create PowerShell -bypass -nop -hidden. HTTP POST multipart macOS Chrome UA. Origin: null.jsbin.com. .tpp0/.tpp1 extensions.

阅读报告 →