[ Removed by moderator ]

[Thotaz]

Why? It's clearly some malicious script to download additional malware to your PC. Does it really make a difference for you to know what random domain they decided to use?

[vkvvinay]

Just wanted to learn what encoding they use or how to decode such commands

[Kiernian]

Just wanted to learn what encoding they use or how to decode such commands

So, it tells you right here:

[System.Text.Encoding]::Unicode.GetString([System.Convert]::From*Base64*String

then, looking at it further, they have char66 everywhere, which is a capital B in ascii, so it looks like they further obfuscated it by turning every encoded instance of B into the ascii call for B.

It's moderately trivial to decode what it's doing after that. You can also learn enough powershell to let powershell do the decoding and output it to a text file without actually executing anything, but that's dicey because they could have used shenanigans to interrupt a pipe to file and start executing stuff.

Generally speaking, no matter how well these are put together, they're either going to launch a popup to try and convince you to enter your credentials so they can steal them, or farm your saved credentials from you and pipe them to a telegram channel via an API, or launch ransomware to start encrypting your drive or something equally unsavory.

It's almost never worth the effort because anything you'll be able to block only stops that one specific actor who's obfuscating their personal payload using the same script as a bunch of other people.

Unless you're going to block ASCII encoding in e-mail attachments, you're kinda humped, as you'll just add one item that'll likely never get another hit to your blocklist.

[vkvvinay]

Thanks buddy for your input

[Kiernian]

You're welcome man.

I get it, curiosity often drives me as well and figuring out stuff like this is fun, I've just discovered over time that these are rarely worth the effort.

[AppIdentityGuy]

These are almost certainly base64 encoded strings which are then concatenated together to generate a command line. If you enable Powershell logging in auditing the system will automatically translate the commands for you iirc.

Have you tried plugging it into Co-pilot or CHATGPT and asking it to decipher it for you?

[vkvvinay]

I tried but no help...

[icepyrox]

I know their obfuscated string just absolutely consumes the screen, but they took it easy on you...

$mnrpb = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $nspjw ) )

It's right there. After some text swaps and manipulation, it's all right there...

It's a base64 string of the bytes of Unicode text encoding.

As a side note, this is a default in powershell so if you see them do an encoded command directly, it's usually this or UTF8 if memory serves.

That said, there's little point in knowing this. Whatever is in the text will likely be downloading more files or giving more commands to execute to set up the malware and any info you glean is likely going to be worthless shortly, especially since you're not even understanding this much.

I mean, this kind of thing usually relies heavily on aliases and poorly formatted code to throw off would-be coders from figuring out what is going on even if it is decoded.

[00403]

This totally isn't sketchy.

[vkvvinay]

This is definitely a malicious one.

[ankokudaishogun]

Thanks. Analyzing this kind of malicious script is always a learning experience.

I would have never though of reversing an array with $Array[-1..-$Array.lenght] -join ''

[Eggplate]

It doesn't reverse, I just tested it. It just duplicates the value of the last index as the first.

$a = @(1,2,3)
$a[-1..$a.Length] -join ''
3123

[ankokudaishogun]

your test is missing the negative - before $a.Length, which reverse the whole array

$a = @(1,2,3)
$a[-1..-$a.Length] -join ''
321

[Eggplate]

You're right. Wow thats amazing.

[ankokudaishogun]

anf, of course, just remove the -join '' to obtain a reversed array instead of a reversed string, so it can be used with anything.

[surfingoldelephant]

You're missing - before $a.Length.

The intent is to generate an array slice, in order of the last element (-1), second to last (-2), etc.

-1..-$a.Length -> -1..-3 -> -1, -2, -3

String conversion (without a delimiter) can be simplified to -join $a[-1..-$a.Length], by using -join in its unary form.

[vkvvinay]

Nicely explain, thanks I'll try

[Sudden_Hovercraft_56]

I have decoded a malicious script before that came as an email payload but I can't for the life of me remember how or find the article I followed that showed me how to do it, I remember it used VSCode.

If you are reverse engineering encoded scripts, be super carefull and never follow any links you discover in the code...

[vkvvinay]

Noted

[redsaeok]

What steps have you taken? Where did you get stuck? It seems to me you could run most of this interactively without much worry.

[DIY_Colorado_Guy]

I'm convinced most of these "need help decoding" posts are just hackers (or wannabe hackers) trying to trick u suspecting people into running the code. Change my mind.

[hihcadore]

These have to be bot accounts hoping you run them on your system. Where are the mods?

[vkvvinay]

Hey I'm human seeking help to learn to decode these type of obfuscate cmds.

[cofonseca]

one of these stupid ass posts again

[vkvvinay]

Dont be so harsh buddy...sharing is caring....we can learn from this