MaleficAms & Quasar
Fighting MaleficAms.C and Quasar.GG!MTB // 30th January 2025
Last updated
Fighting MaleficAms.C and Quasar.GG!MTB // 30th January 2025
Last updated
This torrent: rarbgo dot to/torrent/fontlab-8-0-0-8222-neverb-5320179.html , contains a crack.zip file. The crack is a virus. It didn't flash anything up on my screen for 2 days but when it did, I spent several hours chasing it around my system. DO NOT USE IT. It seems to be one of the new virus types that collects your browser's logged-in session tokens and sends them to a hacker.
The crack file doesn't contain much, but it activates a remote script, which then downloads other files and hides them around your system.
It also created two tasks in Task Scheduler, which ran every time the computer woke up from sleep.
Make sure you activate tasks history: Task scheduler → Action menu → Enable All Tasks History.
Also get ProcExp from Microsoft's SysInternals, it's more powerful than Task Manager (and also way more lightweight, who even made Task Manager heavy?). Run it as administrator.
Disable your internet connection. If you don't trust that your wifi is fully off, create a firewall block rule that blocks everything outbound.
Check Windows Security → Virus & threat protection settings → Exclusions. Make sure that NO folders or files are excluded. (Check the same thing in your antivirus app if you're using something else.)
Here I'll list all the places I found files. The file names may be different for you.
There may have been some more files but I forgot where they were.
There's also a registry key masquerading as a Realtek device entry. HKey Local Machine / Software / RealtekgaNtkX0 / NtkX0rW.
The rogue code kept launching new powershell instances, and sometimes CMD instances.
Watch for them in ProcExp.
You can sort the processes by PID so the newest processes should appear at the top of the list.
The virus also added powershell.exe and my entire C:\ drive to the Windows Security antivirus exclusions list, so I was getting notifications from Windows Security that no threats had been found. Once I removed all exclusions from the list, it detected one virus, then later, the other one.
Windows Security finally detected two viruses:
Win32/MaleficAms.C — This program is dangerous and executes commands from an attacker.
MSIL/Quasar.GG!MTB — This program provides remote access to the computer it is installed on.
This was after I had deleted the other files by myself, so your antivirus software may detect more than mine did. I also uploaded the virus files to VirusTotal, and it shows that some antivirus software doesn't detect these files at all! Check out the links to pages on VirusTotal below.
I recommend using to edit your registry, because it has undo built into the app. As far as I can tell, you can undo something that you changed previously, even days or weeks ago.
LbuDYVey.ps1 — This seems to be the originating file from which the chain of events started —
5.vbs (base64 powershell directives) —
c.bat AND dwm.bat —
8026C5C2-B019-46B0-B0F4-0583866B9AC8 (in Task Scheduler) —
RealtekgaNtkX0 / NtkX0rW — The registry key that was added —
crack.zip file — The crack.zip that was contained as the cracking method —
Patch.exe — The activator executable inside the crack.zip file —
evbda.sys — A benign system file, distributed by Microsoft. It was included in the crack.zip file.
