PS1

Executive Summary

PS1 is a Windows loader used in the CostaRicto campaign to deploy 64‑bit backdoor binaries. It downloads the payload from a remote C&C server, establishes persistence, gathers system information, and sets up encrypted command channels for further exploitation. The loader’s stealthy operation poses a significant insider risk if not properly mitigated.

PS1 is a lightweight loader that was deployed as part of the CostaRicto campaign to deliver 64‑bit backdoor binaries onto infected Windows systems. The loader is designed to be stealthy, avoiding visible execution traces and quickly establishing persistence before handing control over to the final payload. Upon execution it typically downloads or receives the full backdoor from a command & control (C&C) server, validates its integrity, then writes it to disk in a hidden location or loads it directly into memory. After the backdoor is installed, PS1 orchestrates a range of post‑infiltration activities: it collects system information, enumerates users and processes, and establishes encrypted channels for further command execution. The loader also attempts to privilege‑escalate by exploiting local vulnerabilities or leveraging existing administrative accounts. By delivering 64‑bit binaries the campaign was able to evade many legacy security controls that focus on 32‑bit executables. In sum, PS1 serves as a delivery and installation mechanism for the CostaRicto backdoors, enabling attackers to maintain persistence, gather telemetry, and launch additional malicious activity from inside target networks.

Key Capabilities

• Deploys 64-bit backdoor binaries via remote download or injection
• Establishes persistence on victim systems
• Collects system and user information for reconnaissance
• Maintains an encrypted command & control channel for further exploitation
• Attempts privilege escalation on local machines

ATT&CK Techniques

Recommended Actions

• Block outbound traffic to known CostaRicto C&C IP ranges using firewall rules
• Deploy file integrity monitoring to detect the creation of hidden or unusual executable files in critical directories
• Implement application whitelisting and block execution attempts by unknown installers or loaders
• Use behavioral detection tools (EDR) to flag memory injection and remote code download activity from suspicious network flows

Suggested Tags