Investigating a Multi-Stage PowerShell Loader
A threat hunting investigation identified suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both retrieving ZIP archives from Vercel-hosted infrastructure. The PowerShell loaders extract and execute payloads locally, including Grape.exe, UltraToolliteSetup.exe, and draw.io.exe. Analysis revealed heavily obfuscated PowerShell stages utilizing Base64 encoding, XOR-based obfuscation with the key 'Write', dynamically constructed IEX commands, and hidden PowerShell execution. A decoy 'Verification complete!' message disguised as Google.com was presented to victims during execution. Multiple Vercel instances hosted additional artifacts including loader scripts and executables. The initial infection vector remains unidentified, suggesting these PowerShell-hosting URLs represent second-stage delivery points in a multi-stage attack chain.
AI Analysis
Technical Summary
This campaign involves suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both hosted on Vercel infrastructure. The PowerShell loaders extract and execute multiple payloads locally. Analysis shows multiple obfuscation layers including Base64 encoding, XOR-based obfuscation with the key 'Write', and dynamically constructed IEX commands to hide execution. A decoy message is presented to victims to mask malicious activity. Multiple Vercel instances host additional loader scripts and executables. The initial infection vector remains unidentified, suggesting these URLs are second-stage delivery points in a multi-stage attack chain.
Potential Impact
The campaign enables execution of multiple payloads on victim systems through obfuscated PowerShell loaders, potentially allowing attackers to deploy malicious executables locally. The obfuscation and decoy messaging complicate detection and analysis. The initial infection vector is unknown, which limits understanding of full attack scope. No known exploits in the wild have been reported for this campaign at this time.
Mitigation Recommendations
No official patch or fix is applicable as this is a multi-stage loader campaign rather than a software vulnerability. Defenders should block or monitor access to the identified domains and IP addresses (e.g., dorenzaa.com and 203.188.171.166) and investigate any PowerShell execution involving the described obfuscation techniques and payload hashes. Since the initial infection vector is unknown, focus on detection and containment of the second-stage payload delivery is recommended.
Indicators of Compromise
- domain: dorenzaa.com
- hash: d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64
- hash: 3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61
- hash: b385111d6599a30210b7be8f7674a163
- hash: b02d6b80c14bc5556bd7eaa6f1bc502b59818f90
- hash: 0cd022f31b436d6c83ddc1b5c14d47dc
- hash: 5efe9666ca501077aefc818dae7be59f
- hash: 2fdc615e948222bec395f988bebcea4da854756d
- hash: 65e1bb0b0594e9264747640aead433a7bd4fe4fd
- hash: 4366679a4fea2c1bf7e29290f8e162e0db9d0707030b5b99ce870195afeb3782
- hash: a25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1
- hash: dbaf04df50088031ea64a9879c1adeee8b7e551c79dc247fa1bb4de5b263f7b4
- hash: e04487377e4f976ac18e7c1c5b22bc85e03b4423e73fd490e9d1641758faac81
- hash: f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530
- hash: fe693cc07c5d8a4d479e987e64ffb7473bd79066f3505e7f2c8f0b86815d0f08
- url: https://dorenzaa.com/
Investigating a Multi-Stage PowerShell Loader
Description
A threat hunting investigation identified suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both retrieving ZIP archives from Vercel-hosted infrastructure. The PowerShell loaders extract and execute payloads locally, including Grape.exe, UltraToolliteSetup.exe, and draw.io.exe. Analysis revealed heavily obfuscated PowerShell stages utilizing Base64 encoding, XOR-based obfuscation with the key 'Write', dynamically constructed IEX commands, and hidden PowerShell execution. A decoy 'Verification complete!' message disguised as Google.com was presented to victims during execution. Multiple Vercel instances hosted additional artifacts including loader scripts and executables. The initial infection vector remains unidentified, suggesting these PowerShell-hosting URLs represent second-stage delivery points in a multi-stage attack chain.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This campaign involves suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both hosted on Vercel infrastructure. The PowerShell loaders extract and execute multiple payloads locally. Analysis shows multiple obfuscation layers including Base64 encoding, XOR-based obfuscation with the key 'Write', and dynamically constructed IEX commands to hide execution. A decoy message is presented to victims to mask malicious activity. Multiple Vercel instances host additional loader scripts and executables. The initial infection vector remains unidentified, suggesting these URLs are second-stage delivery points in a multi-stage attack chain.
Potential Impact
The campaign enables execution of multiple payloads on victim systems through obfuscated PowerShell loaders, potentially allowing attackers to deploy malicious executables locally. The obfuscation and decoy messaging complicate detection and analysis. The initial infection vector is unknown, which limits understanding of full attack scope. No known exploits in the wild have been reported for this campaign at this time.
Defensive Guidance
No official patch or fix is applicable as this is a multi-stage loader campaign rather than a software vulnerability. Defenders should block or monitor access to the identified domains and IP addresses (e.g., dorenzaa.com and 203.188.171.166) and investigate any PowerShell execution involving the described obfuscation techniques and payload hashes. Since the initial infection vector is unknown, focus on detection and containment of the second-stage payload delivery is recommended.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://malwr-analysis.com/2026/08/08/investigating-a-multi-stage-powershell-loader/"]
- Pulse Id
- 6a79de355f436f32f159929b
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domaindorenzaa.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hashd8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64 | — | |
hash3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61 | — | |
hashb385111d6599a30210b7be8f7674a163 | — | |
hashb02d6b80c14bc5556bd7eaa6f1bc502b59818f90 | — | |
hash0cd022f31b436d6c83ddc1b5c14d47dc | — | |
hash5efe9666ca501077aefc818dae7be59f | — | |
hash2fdc615e948222bec395f988bebcea4da854756d | — | |
hash65e1bb0b0594e9264747640aead433a7bd4fe4fd | — | |
hash4366679a4fea2c1bf7e29290f8e162e0db9d0707030b5b99ce870195afeb3782 | — | |
hasha25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1 | — | |
hashdbaf04df50088031ea64a9879c1adeee8b7e551c79dc247fa1bb4de5b263f7b4 | — | |
hashe04487377e4f976ac18e7c1c5b22bc85e03b4423e73fd490e9d1641758faac81 | — | |
hashf139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530 | — | |
hashfe693cc07c5d8a4d479e987e64ffb7473bd79066f3505e7f2c8f0b86815d0f08 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://dorenzaa.com/ | — |
Threat ID: 6a79f49ebf8831d53900df7e
Added to database: 08/10/2026, 15:56:14 UTC
Last enriched: 08/10/2026, 16:33:02 UTC
Last updated: 09/23/2026, 22:50:41 UTC
Views: 147
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.