this post was submitted on 02 Apr 2025
7 points (76.9% liked)
techsupport
2719 readers
21 users here now
The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.
If something works or if you find a solution to your problem let us know it will be greatly apreciated.
Rules: instance rules + stay on topic
Partnered communities:
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What is that supposed to do?
I'm not too sure. I think -w runs powershell silently?! I'm hoping someone can figure out the rest.
well thats the neat part, the url it presumably downloads and executes the first payload from has died so no unless you catch it when its live you can't easily replicate what happended on your computer anywhere else i have no clue what the powershell is doing but hiding malware in a weird file or pretending its a different file type and then executing that file isn't uncommon
This example is likely an HTA polyglot. An actual MP4 is merged with a binary, basically. The MP4 will play as normal, but the powershell is responsible for execution of the malware.