Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath '<Current directory>'"
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /FI "WindowTitle eq Valhalla Launcher" /T
- '<SYSTEM32>\taskkill.exe' /F /IM valheim.exe
Modifies file system
Creates the following files
- <Current directory>\launcher.config
Deletes following files that it created itself
- <Current directory>\launcher.config
Substitutes the following files
- <Current directory>\launcher.config
Network activity
UDP
- DNS ASK va###.#ash-portal.by
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%ProgramFiles%\java\jre1.8.0_77\bin\javaw.exe' -jar "<Full path to file>"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c start steam://nav/games/details/892970
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
- '%ProgramFiles(x86)%\steam\steam.exe' -- "steam://nav/games/details/892970"
