Forum Discussion

m1zt3rIL's avatar
m1zt3rIL
Icon for Bronze II rankBronze II
23 days ago

PowerShell Deobfuscation: Ep.9

Hello guys I am now on ep 9 on this fantastic collection but been banging my head for couple of days now for this appreciate any help.

Able to decode the first layer using frombase64 and raw inflate

 

 

 

Then I copied the resulting script and remove some parts to be able to execute it on powershell console I read somewhere that it is a enrypted base64 string given there is a -key on the second layer

 

 

 

I found this article which seems related then followed how to decrypt I tried following it with same variable but I am stuck. Not sure how to do this via Cyberchef as well. Appreciate any help in right direction.

 

 

  • Forgot to paste the article https://medium.com/@nikhilsda/encryption-and-decryption-in-powershell-e7a678c5cd7d