Malware
COOKBOX
According to CERT-UA, COOKBOX is a PowerShell script that implements the functionality of downloading and executing PowerShell cmdlets.
COOKBOX is a PowerShell malware family operated by UAC-0149.
Background
CERT-UA describes COOKBOX as a PowerShell script whose core function is to retrieve and run PowerShell cmdlets. Each infected host receives a distinct identifier derived from cryptographic operations (SHA256/MD5 hashing) applied to the combination of the computer name and disk serial number; this value is sent in the "X-Cookie" header of the HTTP requests used to communicate with the C2 server. The backdoor maintains persistence through a key placed in the OS registry's Run branch, written during initial compromise by a separate PowerShell script (such as the COOKBOX deployer). The code typically relies on several obfuscation techniques, including chr-character encoding, replace() substitution, base64 encoding, and GZIP compression.
Source: Malpedia (Fraunhofer FKIE).