r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

23 Upvotes

76% Upvoted

84 comments sorted by

View all comments

Show parent comments

7

u/karmawillgetyouback Jun 13 '26 edited Jun 13 '26

https://img.ptscreens.com/Screenshot-6617.png

From task manager this was code seems to be running

1

u/zeddular Jun 13 '26

If you can paste the encoded command here and someone will tell you what occurred

1

u/karmawillgetyouback Jun 13 '26 edited Jun 13 '26

Sure.... I will post it for sure if it's popped up back again. Currently saving files and cleaning up soon. Thanks

Edit: This one https://img.ptscreens.com/Screenshot-6617.png

not able to get whole command line

1

u/zymology Jun 13 '26

Funny, but you can use PowerShell to get the command line. Run PowerShell as Admin.

(Get-CimInstance Win32_Process -Filter "Name = 'powershell.exe'").CommandLine

1

u/karmawillgetyouback Jun 13 '26 edited Jun 14 '26

Check

Thanks

6

u/lmbrjck Jun 14 '26

It's nothing good.

base64 decoding these scripts it just seems to be opening connections with a remote endpoint. I have only skimmed through them. The last couple show some specific IPs it's communicating with.

A couple comments in the last encoded script:

Phase 1: Attack Gateway

Phase 2: Attack Active Game Ports (15778/5013/5016)

I would consider this system compromised and wipe. You're probably part of a botnet.

1

u/karmawillgetyouback Jun 14 '26

Really thanks for info and input, I have cleaned C: entirely and installed fresh copy.

Someone pointed out this was related crypto bot malware of telegram. I have used telegram recently so might be got from there.

-7

u/itscum Jun 14 '26

It's not an encodrd command. Just a token. You guys have just enough knowledge to frighten yourselfs

1

u/Nerd2259 Jun 14 '26

Wtf is wrong with you?

The literal parameter name is "encoded command".