Overview
overview
8Static
static
3Goldberg_L...f0.zip
windows10-2004-x64
1Goldberg_L...f0.zip
windows11-ltsc_2024-x64
1Readme.txt
windows10-2004-x64
1Readme.txt
windows11-ltsc_2024-x64
1experiment...pi.dll
windows10-2004-x64
3experiment...pi.dll
windows11-ltsc_2024-x64
8experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
1experiment...nt.dll
windows10-2004-x64
3experiment...nt.dll
windows11-ltsc_2024-x64
3experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
1experiment...er.ini
windows10-2004-x64
1experiment...er.ini
windows11-ltsc_2024-x64
1experiment...nt.dll
windows10-2004-x64
3experiment...nt.dll
windows11-ltsc_2024-x64
3experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
8experiment...er.exe
windows10-2004-x64
3experiment...er.exe
windows11-ltsc_2024-x64
3job_id
windows10-2004-x64
3job_id
windows11-ltsc_2024-x64
8linux/lobb...ct_x64
ubuntu-18.04-amd64
1linux/lobb...ct_x86
ubuntu-18.04-amd64
linux/tool...ces.sh
ubuntu-18.04-amd64
1linux/tool...ces.sh
debian-9-armhf
1linux/tool...ces.sh
debian-9-mips
linux/tool...ces.sh
debian-9-mipsel
linux/tool...der.sh
ubuntu-18.04-amd64
3linux/tool...der.sh
debian-9-armhf
3linux/tool...der.sh
debian-9-mips
linux/tool...der.sh
debian-9-mipsel
Analysis
- max time kernel
899s - max time network
480s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Readme.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
experimental/steam_api.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
experimental/steam_api.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
experimental/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
experimental/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
experimental/steamclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
experimental/steamclient.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
experimental/steamclient64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
experimental/steamclient64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
experimental_steamclient/ColdClientLoader.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
experimental_steamclient/ColdClientLoader.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
experimental_steamclient/steamclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
experimental_steamclient/steamclient.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
experimental_steamclient/steamclient64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
experimental_steamclient/steamclient64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
experimental_steamclient/steamclient_loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
experimental_steamclient/steamclient_loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
job_id
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
job_id
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
linux/lobby_connect/lobby_connect_x64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
linux/lobby_connect/lobby_connect_x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral25
Sample
linux/tools/find_interfaces.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
linux/tools/find_interfaces.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
linux/tools/find_interfaces.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
linux/tools/find_interfaces.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
linux/tools/steamclient_loader.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral31
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral32
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target experimental_steamclient/ColdClientLoader.ini
- Size 207B
- Sample260722-1bty7ace79
- SHA256 34a80ad4554f24adb35f5afedcf8b2022bf4ff32683dabeab68bc083ea330846
- MD5 7df77d2991c64f8e23f908af2721d2aa
- SHA1 4a48619e44e00843556efe24552898033fefe935
- SHA512 31b37cdf534489bf975cbde40939f10cca079deb211880c1435756b95ca8d6445073db771396f08a4b74248da060b6baa405c9a00de7053467b4f95c73fdc5de
- TLSH T11AD022122B40327B4202CF08CE25C6CAC3A2C003481B2C415817F04F1B220EA8B3C03B
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1628 NOTEPAD.EXE
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\experimental_steamclient\ColdClientLoader.ini1⤵
- Opens file in notepad (likely ransom note)
PID:1628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6008
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:272