Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'steam' = 'C:\Users\Public\steam.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\steam
- %APPDATA%\microsoft\windows\start menu\programs\startup\steam.lnk
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%HOMEPATH%\steam.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'steam.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\steam.exe'
Modifies file system
Creates the following files
- %HOMEPATH%\steam.exe
- %APPDATA%\tamper protection.exe
- %TEMP%\i6.t
- %TEMP%\i6.bat
- %TEMP%\i6.f
- C:\users\public\steam.exe
Network activity
Connects to
- 'pa###bin.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'pa###bin.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK pa###bin.com
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\steam.exe'
- '%APPDATA%\tamper protection.exe'
- 'C:\users\public\steam.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGYAYwBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAYQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\i6.bat" "
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "steam" /tr "C:\Users\Public\steam.exe"
- '<SYSTEM32>\taskeng.exe' {5E2E2CD5-6A84-4E1C-963A-519B84266155} S-1-5-21-3691498038-2086406363-2140527554-1000:iguyfsfbht\user:Interactive:[1]
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGYAYwBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAYQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%HOMEPATH%\steam.exe' ' (with hidden window)
- '%APPDATA%\tamper protection.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\i6.bat" "' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%HOMEPATH%\steam.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'steam.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\steam.exe'' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "steam" /tr "C:\Users\Public\steam.exe"' (with hidden window)
- 'C:\users\public\steam.exe' ' (with hidden window)
