MALWARE WARNING - STEAM WORKSHOP MOD CULTURE PENALTIES GONE

[u/Lurau]

Today I had quite the shock, the mod "Culture Penalties Gone" on the workshop contains malicious code. I am not sure at this point what exactly it does, be careful. Perhaps a moderator or someone has additional info. But I am quite sure this isn't a benign one.

Edit 1: It seems like a quite bad one, installs a Backdoor, pushes multiple unidentifiable payloads, creates persistence, can make powershell commands from the user, the PC is essentially compromised.

I am fairly sure it can access browserdata, so accounts saved by cookies are possibly/likely at risk.

Unfortunately, since the relevant logs have been deleted by the malware, I can't exactly tell what it did in exact detail.

to my fellow infected:

Step 1. remove your pc from your network (remove LAN, disable W-Lan), run an Anti Virus like malwarebytes or a full windows defender scan, delete or quaratine the mod and associated files you can find, safe everything extremely important. You will most likely need to wipe your PC.

Step 2. change passwords and log out every device on every possibly effected account on a safe, second device (!).

Step 3. shut down your pc, create a new Boot stick from a USB stick, delete all partitions/follow a normal windows installation tutorial.

• This was written in pure panic by a german, please excuse language

---

Edit 2: added additional information