1. Home
  2. Software
  3. PS1

PS1

PS1 is a loader that was used to deploy 64-bit backdoors in the CostaRicto campaign.[1]

ID: S0613
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 24 May 2021
Last Modified: 11 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1140 反混淆/解码文件或信息

PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.[1]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

PS1 can utilize a PowerShell loader.[1]
Enterprise T1027 .013 混淆文件或信息: Encrypted/Encoded File

PS1 is distributed as a set of encrypted files and scripts.[1]
Enterprise T1105 输入工具传输

CostaBricks can download additional payloads onto a compromised host.[1]
Enterprise T1055 .001 进程注入: Dynamic-link Library Injection

PS1 can inject its payload DLL Into memory.[1]

Campaigns

ID Name Description
C0004 CostaRicto

During CostaRicto, threat actors used the 64-bit backdoor loader PS1.[1]

References

  1. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.