Loader
NosyDownloader
According to ESET Research, this malware is used by LongNosedGoblin and executes a chain of obfuscated commands passed to a spawned PowerShell process as one long command line argument, meaning that t
NosyDownloader is a PowerShell loader.
Background
ESET Research attributes this malware to LongNosedGoblin and notes that it runs a sequence of obfuscated commands handed to a newly spawned PowerShell process as a single long command-line argument, so the script never touches disk. Each following stage is base64-encoded, and the final stage is additionally gzip-deflated. AMSI is bypassed at the second stage, where NosyDownloader relies on Matt Graeber's reflection trick along with script-logging disabling techniques published on GitHub.
Source: Malpedia (Fraunhofer FKIE).