-#
@everyone
### **How the Malware Works**
- `steam.exe` starts by applying a **mempatch** to hide itself from tools like Task Manager, Process Hacker, and Process Explorer.
- It loads an XOR-encrypted **compact PE executable** embedded within itself, which is patched to remain hidden in memory.
- Uses **Pushover API** (a legit notification service) to send stolen data in real-time, such as:
- System info (hardware, network adapters, IPs, etc.)
- Potential keylogs or debug logs.
- Injects `skeet.dll` into `csgo.exe`, hijacking it to act as a sniffer for:
- Low-level NT API functions like `QueryPerformanceCounter`, `GetSystemTimeAsFile`, and `IsDebuggerPresent`.
- `steam.exe` relays all data back to Pushover while staying hidden via memory manipulation.
- Alters **MBR (Master Boot Record)** and **BOOTMGR (bootloader)** to persist through reboots, making removal difficult.
---
### **How to Get Rid of It**
1. **Do NOT Restart:** The malware may corrupt your bootloader upon reboot. First, backup important files (non-executables only).
2. **Enable Core Isolation:** Enabling Core Isolation could help prevent further damage or persistence, but it’s **strongly recommended to reinstall Windows** to fully remove the malware. To enable Core Isolation via registry, run these commands in CMD with admin permission:
- `reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f`
- `reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 1 /f`
- `reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 1 /f`
3. **Reinstall Windows:** Use a bootable USB to wipe the infected drive, delete all partitions, and reinstall the OS.
4. **Update Firmware:** If motherboard-level infection is suspected, update BIOS/UEFI firmware.
5. **Avoid Reuse of Infected Files:** Do not execute old `.exe` or `.dll` files.
---
### **Prevention**
- Avoid cracked software and unverified cheats.
- Use advanced monitoring tools like Sysinternals Suite or GMER.
- Enable Secure Boot, Core Isolation, and keep your system updated.
**Analysis provided by:** <@1192498321877639271>
-# **~ Rollmops Team Management**
