Malware Deep Dive: Examining A PowerShell Payload

This report analyzes a PowerShell-based "living off the land" malware loader found via an HKLM\SOFTWARE Run key; the attacker stored UTF-16 base64 data that decodes to a gzip-compressed PowerShell script, which in turn contains base64-encoded shellcode. The shellcode uses VirtualAlloc/CreateThread and loads WinInet, indicating a downloader that contacts remote hosts to fetch additional payloads; the write-up includes decoding steps, shellcode disassembly, and demonstrates persistence and stealth techniques along with detection/remediation recommendations.