Disclaimer: This article is for educational and research purposes only. Do not use the information herein for illegal activities. The author is not responsible for any misuse.
Why is PowerShell suitable for writing malware ?
How to create malware with PowerShell programming language ?
Hide the window when executing a command
Malware panel
Antivirus bypass
Output
Summary
PowerShell is an official and built-in Windows tool and does not require any prerequisite installation, which is why it has attracted the attention of malware writers. Security systems such as firewalls, antivirus, etc. do not specifically monitor PowerShell, but other programming languages such as Python are detected by antivirus.
We use the Invoke-Expression command in PowerShell to execute PowerShell commands. In C, Python, etc., cmd and PowerShell commands are also available.
The output of this command is the contents of the path where the malware was executed.
But this command has a problem: sometimes, when executing commands, it displays a special window that causes malware to not hide, which we will discuss below...
To fix the problem of the window appearing, we use the Start-Job or Start-Process command, which we will review use together below.
Start-Job
[-Name ]
[-Credential ]
-LiteralPath
[-Authentication ]
[[-InitializationScript] ]
[-WorkingDirectory ]
[-RunAs32]
[-PSVersion ]
[-InputObject ]
[-ArgumentList <Object[]>]
[] [......]
Start-Process
[-FilePath]
[[-ArgumentList] <string[]>]
[-Credential ]
[-WorkingDirectory ]
[-LoadUserProfile]
[-NoNewWindow]
[-PassThru]
[-RedirectStandardError ]
[-RedirectStandardInput ]
[-RedirectStandardOutput ]
[-WindowStyle ]
[-Wait]
[-UseNewEnvironment]
[-Environment ]
[-WhatIf]
[-Confirm]
[] [.....]
Advantage: You can get the output directly in a variable.
For more information and to see more switches, visit the addresses below.
The malware needs a panel to receive commands from you. There are different panels including web, Telegram bot, Flutter, etc. We will talk about the types of panels in the following articles.
There are many techniques for bypassing antivirus, including Process Hollowing, Fileless, Inject, etc., each of which requires expertise in the writing malware field. Below, we will examine one of the common and easy techniques.
Obfuscation
In this type of technique, we obfuscate PowerShell codes, meaning we make it so that the antivirus does not notice this code and bypasses it.
Command encryption, decryption, and execution
Pasted command letters. Another syntax for the Invoke-Expression command is the iex command.
To execute a string (command), we use the & command.
Once we have written our PowerShell malware, we need to compile it or use different techniques like hta files or Bad USB, etc. to infect the target system.
In this article, we learned how to run PowerShell commands in the background and bypass antivirus, etc. If there is enough support, I will post longer and better articles such as malware analysis, autominer, fileless technique, process hole, creating a Telegram panel, Android, web, etc. I hope you enjoyed this article, until the next article goodbye ♥️
If you have any questions, you can refer to this Telegram address.
