Steganographic Loader - Char-Code Obfuscated PowerShell in Temp (T1059.001)

Ethan Andrews@eandrews

•updated Jun 24, 2026•1•0•5

Detects powershell.exe executing a hidden .ps1 script from AppData\Local\Temp using character-code string concatenation obfuscation ([char]N+[char]N) and ForEach-Object {[char]$_} patterns, consistent with the TuglaInsaatci/Remcos steganographic loader campaign dropping pmxhtzb4w2q.ps1 for persistence.