SteamGen2[.]exe | Triage™

Resubmissions

09/07/2026, 16:25

260709-twydsaet4y3

08/07/2026, 13:59

260708-ranaksf19z3

Sharing

Copy URL Twitter E-mail

General

Target
SteamGen2.exe
Size 1.0MB
Sample260708-ranaksf19z
SHA256 e5cdb7814aa133f870d0f834568b78a4db13701680380eaed7769ed00fb45523
MD5 bfc7584f1c8cd9aa01e6d00c3ebecea7
SHA1 69dde4c90416dfd3cee55adde06cbbedd94c6dcc
SHA512 dc59db1402c1af758b10a88ef84aa97087385276ce8fc575f90aa169be2731003db9fc5e7e46f48f120c039461ef5b92fcd2927b28dcb67b0ceea729ce63ac67
SSDEEP 24576:Awt+r62HlvY9wykeqSoqRTeeJfdm1Jx9kF8vLbcQv5BDZZn:AworNHmFoQ41Jx9kF8vLbcQv5BVh
TLSH
T126259E6E67A901E9C1B7D178C6578603EAB274191331DBEF07D086A51F23AE16F3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamGen2.exe

File Explorer

SteamGen2.exe

.exe 1.0MB

SteamGen2.exe

IMPHASH c29c6a0b64d5c53a06b5d83eb4d29d4d
SHA256 e5cdb7814aa133f870d0f834568b78a4db13701680380eaed7769ed00fb45523
MD5 bfc7584f1c8cd9aa01e6d00c3ebecea7
SHA1 69dde4c90416dfd3cee55adde06cbbedd94c6dcc
SHA512 dc59db1402c1af758b10a88ef84aa97087385276ce8fc575f90aa169be2731003db9fc5e7e46f48f120c039461ef5b92fcd2927b28dcb67b0ceea729ce63ac67
SSDEEP 24576:Awt+r62HlvY9wykeqSoqRTeeJfdm1Jx9kF8vLbcQv5BDZZn:AworNHmFoQ41Jx9kF8vLbcQv5BVh
TLSH
T126259E6E67A901E9C1B7D178C6578603EAB274191331DBEF07D086A51F23AE16F3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

749168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW GetFileSizeEx OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW GetProcessHeap GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileType GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW WideCharToMultiByte MultiByteToWideChar GetTickCount QueryPerformanceCounter GetSystemInfo SleepEx HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler GetLastError CloseHandle CreateFileW AllocConsole GlobalUnlock GetModuleHandleW ExitProcess GlobalLock GetProcAddress FreeConsole GlobalFree GlobalAlloc GetConsoleMode Sleep SetConsoleMode GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA ReadFile LoadLibraryW FreeLibrary GetSystemDirectoryW QueryPerformanceFrequency LocalFree LeaveCriticalSection EnterCriticalSection AcquireSRWLockExclusive InitializeCriticalSection ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleHandleA GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetStdHandle

user32

GetKeyState GetMessageA DispatchMessageA LoadCursorA DestroyWindow SetWindowPos MessageBoxW PostMessageA FillRect CreateWindowExW UnregisterHotKey SetWindowTextW ShowWindow MessageBoxA OpenClipboard GetCapture SetTimer CloseClipboard EmptyClipboard RegisterClassW SendMessageW RegisterHotKey MoveWindow DefWindowProcA TranslateMessage SendMessageA SetClipboardData GetClientRect GetWindowLongPtrA DrawTextW UpdateWindow IsWindow PostQuitMessage BeginPaint GetWindowTextW EndPaint KillTimer InvalidateRect

gdi32

CreateSolidBrush DeleteObject SetBkColor SelectClipRgn CreatePen SetBkMode SetTextColor CreateRoundRectRgn SelectObject CreateFontW GetStockObject RoundRect

advapi32

ConvertSidToStringSidA AddAccessAllowedAce CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW OpenProcessToken CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid

shell32

ShellExecuteW ShellExecuteA

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1_Lockit@std@@QEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA

comctl32

InitCommonControlsEx

dwmapi

DwmSetWindowAttribute

msimg32

GradientFill

crypt32

CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCloseStore

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent getsockopt gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl WSAWaitForMultipleEvents select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError accept closesocket

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memchr memcmp memcpy memmove memset __std_terminate strrchr strstr wcschr __current_exception __current_exception_context __C_specific_handler __std_exception_copy strchr __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _seh_filter_exe _set_app_type _resetstkoflw _get_narrow_winmain_command_line _initterm _initterm_e _exit __sys_nerr _c_exit _register_thread_local_exe_atexit_callback exit _beginthreadex _invalid_parameter_noinfo __sys_errlist system _errno _invalid_parameter_noinfo_noreturn _cexit abort

api-ms-win-crt-stdio-l1-1-0

_close _fileno fseek _read feof fclose fflush __p__commode ftell _popen _set_fmode fgetc fgets _lseeki64 __acrt_iob_func _pclose fputc __stdio_common_vsscanf _wfopen _wopen _get_stream_buffer_pointers freopen_s _fseeki64 fread fsetpos ungetc fwrite setvbuf fgetpos _write fputs __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free _callnewh calloc malloc

api-ms-win-crt-math-l1-1-0

_fdopen __setusermatherr _dsign

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtod atoi strtoul wcstombs strtoull

api-ms-win-crt-filesystem-l1-1-0

_wstat64 remove _fstat64 _lock_file _unlock_file _unlink

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 _time64 wcsftime strftime

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-string-l1-1-0

strspn tolower _wcsdup wcsncmp strcspn strncmp strpbrk wcsncpy wcspbrk _strdup strcmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort