PowerShell XOR-decode routine loading payload via Reflection.Assembly (cap.ps1)

Duo Tech@duotech

•updated Jul 2, 2026•0•0•0

Detects PowerShell scripts that contain custom bit-reversal and XOR decoding routines used to deobfuscate an embedded byte blob, followed by the reflective loading of that blob into memory as a .NET assembly using [Reflection.Assembly]::Load. This behavior is associated with loaders like cap.ps1 used to deploy RATs such as AsyncRAT.