MaleficAms & Quasar
Fighting MaleficAms.C and Quasar.GG!MTB // 30th January 2025
This torrent: rarbgo dot to/torrent/fontlab-8-0-0-8222-neverb-5320179.html , contains a crack.zip file. The crack is a virus. It didn't flash anything up on my screen for 2 days but when it did, I spent several hours chasing it around my system. DO NOT USE IT. It seems to be one of the new virus types that collects your browser's logged-in session tokens and sends them to a hacker.
The crack file doesn't contain much, but it activates a remote script, which then downloads other files and hides them around your system.
It also created two tasks in Task Scheduler, which ran every time the computer woke up from sleep.
IMPORTANT FIRST STEPS
Make sure you activate tasks history: Task scheduler → Action menu → Enable All Tasks History.
Also get ProcExp from Microsoft's SysInternals, it's more powerful than Task Manager (and also way more lightweight, who even made Task Manager heavy?). Run it as administrator.
Disable your internet connection. If you don't trust that your wifi is fully off, create a firewall block rule that blocks everything outbound.
Check Windows Security → Virus & threat protection settings → Exclusions. Make sure that NO folders or files are excluded. (Check the same thing in your antivirus app if you're using something else.)
All the files that I found
Here I'll list all the places I found files. The file names may be different for you.
There may have been some more files but I forgot where they were.
There's also a registry key masquerading as a Realtek device entry. HKey Local Machine / Software / RealtekgaNtkX0 / NtkX0rW.
Defence
You, fighting it in realtime
The rogue code kept launching new powershell instances, and sometimes CMD instances.
Watch for them in ProcExp.
You can sort the processes by PID so the newest processes should appear at the top of the list.
Windows Security
The virus also added powershell.exe and my entire C:\ drive to the Windows Security antivirus exclusions list, so I was getting notifications from Windows Security that no threats had been found. Once I removed all exclusions from the list, it detected one virus, then later, the other one.
Windows Security finally detected two viruses:
Win32/MaleficAms.C — This program is dangerous and executes commands from an attacker.
MSIL/Quasar.GG!MTB — This program provides remote access to the computer it is installed on.
This was after I had deleted the other files by myself, so your antivirus software may detect more than mine did. I also uploaded the virus files to VirusTotal, and it shows that some antivirus software doesn't detect these files at all! Check out the links to pages on VirusTotal below.
Files checked on VirusTotal:
LbuDYVey.ps1 — This seems to be the originating file from which the chain of events started — https://www.virustotal.com/gui/file/5afdc33f02df4604b5610fe0c31131a889df29687353b1c0f300c1cf791192cb
5.vbs (base64 powershell directives) — https://www.virustotal.com/gui/file/a63181dff0f68b98712247f51c8a6e7761f8a84261928c297b12f438272c1492
8026C5C2-B019-46B0-B0F4-0583866B9AC8 (in Task Scheduler) — https://www.virustotal.com/gui/file/257a73e0adedae700e848f36cbcf4198d478fb8cb4aab2855ebef496c7fca60d
RealtekgaNtkX0 / NtkX0rW — The registry key that was added — https://www.virustotal.com/gui/file/bf0814ba984aac3d577d45da9b06da36443c523241ec083120874cdacf65bf6c
crack.zip file — The crack.zip that was contained as the cracking method — https://www.virustotal.com/gui/file/d2b9cbc27e4328493cc918110de5d2c3339f79075466311b3b45a72faf86fe76
Patch.exe — The activator executable inside the crack.zip file — https://www.virustotal.com/gui/file/7dbc709cf291f300f458170fa4552e8a85187afc56b72ad073ffc4ea0d026c61
evbda.sys — A benign system file, distributed by Microsoft. It was included in the crack.zip file. https://www.virustotal.com/gui/file/48d9f61e943a7855562950ff26b866bd51a27d980757b065504fcd3f1a1d6f07
Last updated
