General
-
Target
https://cdn.discordapp.com/attachments/1311132903513784388/1311379460439670867/SteamtoolsSetup.exe?ex=6757254b&is=6755d3cb&hm=6ff1dda99a5dc913e3645f609584cf02a861a25bbb26f55383f4b6bb433391f2&
-
Sample
241209-b3qy6ssmbj
Score
8/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1311132903513784388/1311379460439670867/SteamtoolsSetup.exe?ex=6757254b&is=6755d3cb&hm=6ff1dda99a5dc913e3645f609584cf02a861a25bbb26f55383f4b6bb433391f2&
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Detected potential entity reuse from brand STEAM.
-