SteamtoolsSetup[.]exe

Resubmissions

14/08/2024, 12:35

240814-pshrpssdpb8

14/08/2024, 12:23

240814-pkklbssamh8

Sharing

Copy URL Twitter E-mail

General

Target
SteamtoolsSetup.exe
Size 1.7MB
Sample240814-pshrpssdpb
SHA256 036128ca60c543609bf2c6c362e2f909c85f1760d4a8d6b07c55b73d36d9df0b
MD5 dd410c316152077eb8a683ed981fc787
SHA1 360b90cd99dd9ead20b21e50c73a3d0fe10123c1
SHA512 81f4dceebe93a89b239076937df31bf28542b23ed8e383ca9b30cbdcd89b3d8683fc8fff9c78d74c1ced281e766cb852b54b6c5b5640b6cb0224b66c747d8657
SSDEEP 24576:nkcCSfG0yWS7woCNAi1GoCaLI4/gPGHOV1VVW4Qn652aPOrjB9:kcCSe0yT7wooAi1GhWI4oPGHOVVWvcC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamtoolsSetup.exe

File Explorer

SteamtoolsSetup.exe

.exe 1.7MB

SteamtoolsSetup.exe

IMPHASH 0d0cd7f84f2e605d08908bc8a7aa2a06
SHA256 036128ca60c543609bf2c6c362e2f909c85f1760d4a8d6b07c55b73d36d9df0b
MD5 dd410c316152077eb8a683ed981fc787
SHA1 360b90cd99dd9ead20b21e50c73a3d0fe10123c1
SHA512 81f4dceebe93a89b239076937df31bf28542b23ed8e383ca9b30cbdcd89b3d8683fc8fff9c78d74c1ced281e766cb852b54b6c5b5640b6cb0224b66c747d8657
SSDEEP 24576:nkcCSfG0yWS7woCNAi1GoCaLI4/gPGHOV1VVW4Qn652aPOrjB9:kcCSe0yT7wooAi1GhWI4oPGHOVVWvcC
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1073388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\gip\my_updater\target\release\deps\my_updater.pdb

advapi32

RegQueryValueExW SystemFunction036 RegCloseKey RegOpenKeyExW

kernel32

HeapFree CloseHandle WaitForMultipleObjects GetOverlappedResult GetLastError WaitForSingleObject GetExitCodeProcess AcquireSRWLockExclusive AddVectoredExceptionHandler SetThreadStackGuarantee HeapAlloc GetProcessHeap HeapReAlloc GetStdHandle GetConsoleMode GetFileInformationByHandleEx ReleaseSRWLockExclusive GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleMode SwitchToThread FillConsoleOutputCharacterA FillConsoleOutputAttribute AcquireSRWLockShared ReleaseSRWLockShared SetLastError GetFinalPathNameByHandleW TryAcquireSRWLockExclusive GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes WakeAllConditionVariable SetHandleInformation GetModuleHandleA GetProcAddress GetCurrentThread MultiByteToWideChar WriteConsoleW QueryPerformanceFrequency GetModuleHandleW FormatMessageW WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA GetCurrentProcess ReleaseMutex GetEnvironmentVariableW RtlLookupFunctionEntry GetTempPathW CreateFileW GetFileInformationByHandle GetFullPathNameW SetFilePointerEx CreateDirectoryW FindFirstFileW FindClose ReadConsoleW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx CreateEventW CancelIo ReadFile QueryPerformanceCounter GetCurrentDirectoryW RtlCaptureContext DeleteFileW SetFileAttributesW SleepConditionVariableSRW SetCurrentDirectoryW WakeConditionVariable PostQueuedCompletionStatus GetConsoleOutputCP FlushFileBuffers HeapSize LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess WriteFile RtlPcToFileHeader LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime

ntdll

NtWriteFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx

ws2_32

shutdown getpeername WSAGetLastError WSAIoctl closesocket WSASend WSASocketW ioctlsocket setsockopt connect getsockopt bind getaddrinfo freeaddrinfo WSAStartup WSACleanup recv send getsockname

crypt32

CertFreeCertificateContext CertDuplicateStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertOpenStore CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain

secur32

QueryContextAttributesW ApplyControlToken AcquireCredentialsHandleA InitializeSecurityContextW AcceptSecurityContext EncryptMessage FreeCredentialsHandle DeleteSecurityContext DecryptMessage FreeContextBuffer

bcrypt

BCryptGenRandom

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

520KB

Virtual Size

519KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

SteamtoolsSetup.exe

advapi32

kernel32

ntdll

ws2_32

crypt32

secur32

bcrypt

generic