Huntress analyzes host-keyed PowerShell malware that loads Meterpreter
Summary
Huntress analyzed a PowerShell service command whose decoder uses host and user details as a key. Analysts recovered a payload that stages Meterpreter for in-memory execution.
Key points
- Huntress found a PowerShell command configured to run as a service on a host with multiple malicious footholds.
- The command combines hexadecimal data with a Base64-encoded decoder.
- The decoder builds a key from the computer name, username, domain, and IP address, making the payload host-specific.
- Analysts hard-coded the known host key to decode the payload without executing it.
- The decoded payload is a stager designed to download and run Meterpreter directly in memory.
- The stager included an error message suggesting a firewall or antivirus product could block its Connect method; Huntress said the customer had not engaged a penetration-testing company.
Article Details
- Attack Vectors
- A PowerShell command configured to run as a service launched an encoded command through nested cmd.exe processes.
- The payload was keyed to the host using its computer name, username, domain name, and IP address, restricting decoding to the matching environment.
- The decoded payload was a stager designed to download and execute Meterpreter directly from memory.
- Defensive Notes
- Inspect encoded PowerShell by decoding it or observing it during execution; host-keyed payloads may not decode in a different environment.
- The analysts hard-coded the key using known host details and printed the decoded payload rather than executing it.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe PowerShell command concealed its content using a hexadecimal string and a Base64-encoded decoder.T1059.001 · PowerShellPowerShell ran the encoded command that decoded the host-keyed payload.T1059.003 · Windows Command ShellThe command used nested cmd.exe processes to launch PowerShell.T1105 · Ingress Tool TransferThe decoded stager was designed to download Meterpreter.T1140 · Deobfuscate/Decode Files or InformationThe decoder used host-specific details as a key to decode the payload.T1543.003 · Windows ServiceThe PowerShell command was configured to run as a service.T1620 · Reflective Code LoadingThe stager was described as executing Meterpreter directly from memory.