How I traced an obfuscated PowerShell chain to an in-memory .NET payload.

I worked through the loader one stage at a time: decoding the Base64 content, recovering the RC4-encrypted script and tracing how it loaded an embedded PE through the .NET runtime.

VIEW ORIGINAL LINKEDIN POST ↗

Agent Tesla staged execution analysis from obfuscated script to static evidence — EXECUTION ANALYSIS / CONDENSED STATIC-RESEARCH VIEW

EXECUTION CHAIN

STAGE 01Initial obfuscated scriptEmbedded Base64 content and cleanup behavior.

→

STAGE 02RC4 + PowerShellDecode, decrypt and recover the next-stage script.

→

STAGE 03In-memory .NET loaderAssembly.Load, Reflection and process-conditioned execution.

→

PAYLOADEmbedded PERecovered for static analysis without executing the final payload.

KEY FINDINGS

The execution chain is staged and designed to minimize persistent artifacts on disk.
The second stage performs Base64 decoding and RC4 decryption before dynamic PowerShell execution.
The final loader reconstructs a PE/.NET assembly and loads it directly through System.Reflection.Assembly.Load.
Reflection is used to locate and invoke methods from the loaded assembly.
A continuous process-monitoring loop gates payload execution based on the host environment.

INDICATORS / SHA1

Initial script940c1b694e0a211b11a9e4a71e03a713550da5a7

Secondary scripte975f9ca9f50b50f04b4ce174734cb13a111e6b6

Final payload576006af4b33c4c894087510248eb5512019dcca

Binary2e6a3a9ab81ecf480411ee70396fc361c1931654

PORTFOLIO NOTE

This page condenses my original analysis around the execution chain and the evidence supporting the findings.