PowerShell Loader Uses In-Memory Execution to Deliver Cobalt Strike Beacon
Summary
Researchers traced a PowerShell shellcode loader found on an open directory to a Cobalt Strike Beacon. The loader used in-memory execution, API hashing, and a Baidu Cloud endpoint before connecting to a Russian C2 server.
Key points
- The y1.ps1 loader was found in an open directory on a server in China and was first observed on June 1, 2025.
- It decodes and XOR-decrypts embedded shellcode, then executes it in memory using dynamically resolved Windows APIs.
- The shellcode uses API hashing, a forged browser User-Agent, and reflective DLL loading to hinder detection.
- It contacts a second-stage server hosted on Baidu Cloud Function Compute and downloads a payload into executable memory.
- The extracted Cobalt Strike Beacon configuration points to 46.173.27.142 on port 50050; SSL certificate metadata also indicated Cobalt Strike.
- The researchers reported additional Cobalt Strike-related infrastructure across China, Russia, Singapore, Hong Kong, and the United States; attribution remains unclear.
- Recommended defenses include PowerShell logging and restrictions, monitoring for in-memory execution and suspicious outbound traffic, and deploying the listed indicators.
Article Details
- Attack Vectors
- A malicious PowerShell script hosted in an open directory decodes and XOR-decrypts embedded shellcode, then executes it in memory.
- The shellcode downloads a second-stage payload from a Baidu Cloud Function Compute endpoint and executes it from allocated memory.
- The loader uses API hashing, reflective DLL loading, and a forged browser User-Agent string to hinder detection.
- Defensive Notes
- Restrict unsigned PowerShell scripts and enable PowerShell logging; monitor for suspicious commands and custom memory allocation.
- Block the reported malicious IP addresses and Baidu Cloud endpoint, and monitor outbound traffic for forged browser User-Agent strings.
- Use EDR capable of detecting in-memory execution and reflective DLL loading; enable Windows Defender Exploit Guard and ASR rules.
- Monitor for SSL certificates with names such as "cobaltstrike," limit internet access from sensitive machines, and avoid running unknown scripts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | y2n273y10j[.]cfc-execute[.]bj[.]baidubce[.]com | Reported second-stage C2 endpoint used by the shellcode to download a payload. |
| IPV4 | 111[.]229[.]158[.]40 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 114[.]116[.]50[.]214 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 116[.]114[.]20[.]180 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 121[.]37[.]66[.]33 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 123[.]207[.]215[.]76 | Host of the malicious PowerShell script y1.ps1 in an open directory. |
| IPV4 | 124[.]223[.]12[.]165 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 124[.]71[.]137[.]28 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 137[.]184[.]103[.]54 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 146[.]190[.]72[.]88 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 150[.]158[.]214[.]98 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 167[.]71[.]215[.]63 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 175[.]178[.]33[.]154 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 182[.]92[.]76[.]239 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 217[.]114[.]8[.]138 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 35[.]240[.]168[.]8 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 43[.]202[.]62[.]102 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 45[.]147[.]201[.]165 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 46[.]173[.]27[.]142 | Cobalt Strike Beacon C2 address extracted from the payload configuration. |
| IPV4 | 8[.]134[.]148[.]103 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 8[.]135[.]237[.]16 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 8[.]137[.]147[.]254 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 8[.]210[.]77[.]1 | Listed as a Cobalt Strike open-directory host. |
| IPV4 | 82[.]157[.]78[.]234 | Listed as a Cobalt Strike open-directory host. |
| SHA256 | 1d4f814d06a3893545f51f1158d6677b1b083a90ab57ba03c58f8d26c29e5a10 | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | 1f0f4415b738198cc82359212f3ead281b7eb38070163a7782584f77346e619f | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | 23a04d2ae94998b26c42c327f9344b784eb00d0a42c0ade353275bdedff9824f | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | 27f88c7005f33bfc67731cb732c7c72e0cea7f97db1f15bcf5880d3e7f7f85eb | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | 60652f62ec7772b611f3a62fd93d690e677b616e972a0444650f0a2ea597f77f | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | 6954005ab1b1d2deec940181674000e394f860fe4f626d6b0abf63453d5fff48 | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | 69b1261eac205aefb6a5237ff3d87ef515e838184c1616ec935a4f7f4aa04ac1 | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | cdd757e92092b9a72dec0a7529219dd790226b82c69925c90e5d832955351b52 | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
| SHA256 | ed2b7d55781414cdb3e0f64de6d9fea9bf282ee49e12b112f9e0748d5266fd60 | SHA-256 of a PowerShell script listed in the article's Cobalt Strike IOCs. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe shellcode uses API hashing to conceal API function names, and the script's embedded shellcode is Base64-encoded and XOR-encrypted.T1055.001 · Dynamic-link Library InjectionThe article describes reflective DLL injection to load the payload directly into memory.T1059.001 · PowerShellThe loader is a PowerShell script that runs the shellcode-loading sequence.T1071.001 · Web ProtocolsThe shellcode communicates with its C2 over HTTPS using HTTP request APIs.T1105 · Ingress Tool TransferThe shellcode connects to a second-stage server, downloads a payload, and executes it.T1620 · Reflective Code LoadingThe shellcode downloads a payload and executes it from memory; the loader also uses reflective DLL loading.
Products
Tools
Attack Capture File ManagerThe PowerShell script was discovered using the Attack Capture File Manager. The file was flagged as malicious and made publicly accessible via an open directory.Cobalt StrikeThis PowerShell loader reflects an active post-exploitation setup leveraging stealth techniques and Cobalt Strike infrastructure.Code SearchWe used Code Search with the keyword "func_get_delegate_type", a function often associated with reflective execution in PowerShell-based loaders, and filtered for files with the ".ps" extension. This returned 129CyberChefWe returned to the script and used CyberChef to decode the embedded shellcode. The payload was Base64-encoded and XOR-decrypted using a key of 35.
Countries
ChinaWhile analyzing open directories during a routine threat hunting session, we discovered a suspicious PowerShell script (y1.ps1) hosted in an open directory on a server in China (IP: 123.207.215.76).Hong Kongto Chinese and Russian servers, we also identified a few hosted in the United States, Singapore, and Hong Kong. This suggests that although the core staging environment relies heavily on infrastructure in China andRussiaThe final payload communicates with a known Cobalt Strike IP address in Russia.Singaporecase are linked to Chinese and Russian servers, we also identified a few hosted in the United States, Singapore, and Hong Kong. This suggests that although the core staging environment relies heavily onSouth KoreaUnited StatesIOCs in this case are linked to Chinese and Russian servers, we also identified a few hosted in the United States, Singapore, and Hong Kong. This suggests that although the core staging environment relies heavily on