So, as the title say I made a typo yesterday, I executed the PowerShell tool by typing it directly and switched the ‘h’ and the ‘r’ in Chris, so it installed malware and set two programmed tasks to run next time I logged in, this morning I noticed a python instance reading my OneDrive files, It was so fishy that I ended the tasks and started looking into what happened. When I noticed that the command I ran yesterday had a typo I downloaded the script instead of running it again y saw what it did, all I could see for sure is that it installed something and programmed the tasks for running it, I know it read a lot of files in my computer but can’t be sure what else it did exactly and what information might have been compromised, I already changed a bunch of password and am currently fresh installing windows.
I was wondering if someone here that knows more of these things can tell me exactly what does the malware do. I would like to know if there are more things that I need to do to be safe.
Discord: reverieviee: Yeah, I looked into this a bit. I checked the typo you described on VirusTotal and it didn’t come back as malicious, but that doesn’t necessarily mean it was safe. VirusTotal can miss things, especially if the site changes what it serves depending on how it’s accessed.
There actually have been malicious typosquats of the Chris Titus WinUtil site, although the known ones I found are different typos from yours. What’s interesting is that the malware from those sounds pretty similar to what you experienced, scheduled task persistence, Python running in the background, and information-stealing behavior.
So I can’t say it was the same malware without actually analyzing what that domain served at the time. I’d need to set up an isolated malware-analysis VM and dig into it, which would actually be a pretty fun experiment.
Since you’ve already reinstalled Windows and changed passwords, I’d also sign out/revoke all existing sessions for important accounts, especially Microsoft, Google/email, password managers, etc., enable/check MFA, and review recent login activity. If you had anything particularly sensitive in OneDrive, I’d assume it could have been accessed until you know otherwise.