FILEMembers
FILE

Installer turns an obscure resource file into PowerShell input

The executable dropped `Amnesias.Und`, then launched PowerShell to read its contents and derive a command name from them. A separate test of the same script content produced a desktop PE, but the records do not show that output as a completed stage of the installer run.

Oct 26, 2026, 10:20 (UTC+9)Last seenOct 26, 2026Severity77ByCTX TeamActorKimsukyVelvet ChollimaIOC9MITRE27RegionsPK

The executable’s PowerShell child did not launch a conventional .ps1 file. Its command read Amnesias.Und from a directory under the user’s roaming profile, extracted three characters from the file’s contents and used the resulting string as a command name. That raises a more useful question than whether the installer used PowerShell: was this obscurely named file a passive resource, or part of the execution mechanism? The records establish the latter.

Members only

Members-only article

This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.

Sign in to read
Source: CTX Threat Intelligence