Thread by @pmelson

THREAD
A quick walk-through of analyzing a PowerShell backdoor using Python.
Here's the backdoor if you want to play along at home: pastebin.com/JbYwq9WJ

1. Looking at the raw payload, we can see powershell.exe is invoked and a base64-encoded script is passed for execution.

2. Open Python, import the base64 module, create a string of the original encoded script, and another string (step1) of the decoded script.

3. The script is a unicode string, so we need to strip the null bytes with replace, then we can see the script contents. It contains another obfuscated script, which is passed to another invocation of powershell.exe.
(PS - Can you detect powershell.exe launching powershell.exe?)

4. The new obfuscated script is compressed in addition to being base64 encoded, so import zlib in order to decode. In this case, 'H4sI' indicates a gz header, so we'll need to pass 15+32 to zlib.decompress after we decode the base64 string.

5. The decompressed script reflects a base64-encoded blob of shellcode into System.dll. Decode the base64 encoded string, then hex encode the bytes and print them as pairs. The shellcode, likely made with msfvenom, binds a local TCP port (in this case port 4444, the default).

(No, I don't expect that you can read shellcode as hex without a ton of repetitive analysis. You would have Googled "FC E8 82 00 00 00" to find any number of writeups on Metasploit shellcode, like this one: samsclass.info/127/proj/p8bim…)

Found two more of these if you want more examples to play with on your own:
pastebin.com/u6xKPNTh
pastebin.com/vLQ6ZV01