Overview

overview

8

Static

static

3

SteamtoolsSetup.exe

windows10-2004-x64

8

Resubmissions

23-12-2024 14:32

241223-rwlzmssldk 8

23-12-2024 13:20

241223-qk92nazrcv 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SteamtoolsSetup.exe

  • Size

    978KB

  • Sample

    241223-rwlzmssldk

  • MD5

    bbf15e65d4e3c3580fc54adf1be95201

  • SHA1

    79091be8f7f7a6e66669b6a38e494cf7a62b5117

  • SHA256

    c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304

  • SHA512

    9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355

  • SSDEEP

    24576:4Fa9OUi2VoN2gZ1M8UQag3BXrYZt+GgGTfG74T+TRcL:Z9OUiTN2gZ1MExEZkkf+4TARg

Score
8/10
steamdiscoverypersistencephishing

Malware Config

Targets

    • Target

      SteamtoolsSetup.exe

    • Size

      978KB

    • MD5

      bbf15e65d4e3c3580fc54adf1be95201

    • SHA1

      79091be8f7f7a6e66669b6a38e494cf7a62b5117

    • SHA256

      c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304

    • SHA512

      9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355

    • SSDEEP

      24576:4Fa9OUi2VoN2gZ1M8UQag3BXrYZt+GgGTfG74T+TRcL:Z9OUiTN2gZ1MExEZkkf+4TARg

    Score
    8/10
    steamdiscoverypersistencephishing

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Detected potential entity reuse from brand STEAM.

      phishingsteam
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks