ThreatOps Analysis: Keyed Malware | Huntress

The report describes a PowerShell-based, environment-keyed malware stager that derives a decoding key from host identifiers (hostname, username, domain, and IP) to decode a hex payload; when decoded the stager downloads and executes Meterpreter directly in memory, illustrating a targeted evasion technique and detailing how analysts decoded the payload without running it.