From PowerShell to Payload: An Analysis of Weaponized Malware

This blog-style report provides a step-by-step technical breakdown of a PowerShell-based malware launcher embedded in a Windows batch script: the launcher starts hidden PowerShell, decodes a Base64+GZIP blob containing obfuscated PowerShell, uses reflection to resolve Win32 APIs (VirtualAlloc, CreateThread, WaitForSingleObject), allocates executable memory, copies shellcode, and executes it in-memory. The analysis explains each stage of the loader, highlights evasion and in-memory execution techniques, and suggests mitigations such as AppLocker and PowerShell Constrained Language Mode.