A detailed technical walkthrough of a weaponized malware artifact discovered by Huntress ThreatOps. The analysis traces a Windows batch script that chains cmd.exe and multiple PowerShell instances, using architecture detection, hidden windows, Base64-encoded GZIP-compressed payloads, and PowerShell reflection to invoke Win32 API calls (VirtualAlloc, CreateThread, WaitForSingleObject) for loading and executing shellcode in memory. Each layer of obfuscation is peeled back step by step, from the initial .bat trigger through the innermost PowerShell launcher to the raw shellcode byte array.
