Static task
static1
Behavioral task
behavioral1
Sample
steam_group_checker.exe
Resource
win10-20220812-en
General
-
Target
steam_group_checker.exe
-
Size
440KB
-
MD5
0184b5fa5c38b65997a4a1d8c85ea45d
-
SHA1
fa955dc743c51a0f039a541c1daa97ab656b09f9
-
SHA256
60cd1b9d271af92aa8be5713ebb60bb28e8559708bef9eb6313cda506c94e930
-
SHA512
c7b56a7935bd5c6a3017f7f0eac68d500703d8373f82d183f5e5a74b6ebebccbf36ee31e2d1d223f246b517dcb7af2f4b02ca1755f60b0b5fed695dfd322ab1e
-
SSDEEP
12288:shBllDG4xQtDcgXFFCh3YYlvLUGwzvubn3u:shB7GKIcKFyoYlvLB1n3u
Malware Config
Signatures
Files
-
steam_group_checker.exe.exe windows x64
2aba6b3c23d4f8f4dd0bd71a53202b88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileW
GetFileSizeEx
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
GetModuleHandleA
WaitForSingleObjectEx
CloseHandle
GetTickCount
QueryPerformanceCounter
VerifyVersionInfoW
LoadLibraryW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetStdHandle
GetSystemDirectoryW
QueryPerformanceFrequency
VerSetConditionMask
SleepEx
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
GetLastError
SetConsoleTitleA
advapi32
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptAcquireContextW
msvcp140
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_unlock
_Cnd_signal
_Cnd_init_in_situ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Thrd_sleep
_Cnd_init
_Mtx_destroy
_Xtime_get_ticks
_Thrd_detach
_Thrd_start
_Mtx_init
_Cnd_wait
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
wldap32
ord27
ord26
ord118
ord41
ord208
ord73
ord216
ord14
ord46
ord219
ord167
ord142
ord79
ord133
ord147
ord301
ord127
ord145
crypt32
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertAddCertificateContextToStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CertFreeCertificateChain
ws2_32
connect
closesocket
bind
ntohl
recv
select
__WSAFDIsSet
socket
WSAGetLastError
getpeername
htonl
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
send
getsockname
WSASetLastError
vcruntime140
wcschr
__C_specific_handler
_CxxThrowException
memchr
strstr
memmove
strchr
strrchr
memcmp
memset
memcpy
__std_terminate
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
ungetc
fputc
__acrt_iob_func
fflush
_lseeki64
fclose
fgetc
fgets
__stdio_common_vfprintf
__stdio_common_vsprintf
fsetpos
_set_fmode
fgetpos
fread
ftell
fseek
__stdio_common_vfprintf_s
_fseeki64
__p__commode
fwrite
_get_stream_buffer_pointers
_read
_write
_close
setvbuf
fopen
_open
__stdio_common_vsscanf
fputs
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
__p___argv
__p___argc
__sys_nerr
strerror
_exit
exit
_initterm_e
_invalid_parameter_noinfo_noreturn
_initterm
_beginthreadex
_get_initial_narrow_environment
_c_exit
terminate
system
_set_app_type
_getpid
_seh_filter_exe
_cexit
_crt_atexit
_errno
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-filesystem-l1-1-0
_stat64
_access
_fstat64
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
wcsncpy
isupper
strpbrk
strncpy
_wcsdup
strspn
_strdup
strcpy_s
strncmp
wcsncmp
tolower
wcspbrk
strcspn
strcmp
api-ms-win-crt-heap-l1-1-0
calloc
malloc
realloc
free
_set_new_mode
_callnewh
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
atoi
strtoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 326KB - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ