Overview
overview
8Static
static
3Goldberg_L...f0.zip
windows10-2004-x64
1Goldberg_L...f0.zip
windows11-ltsc_2024-x64
1Readme.txt
windows10-2004-x64
1Readme.txt
windows11-ltsc_2024-x64
1experiment...pi.dll
windows10-2004-x64
3experiment...pi.dll
windows11-ltsc_2024-x64
8experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
1experiment...nt.dll
windows10-2004-x64
3experiment...nt.dll
windows11-ltsc_2024-x64
3experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
1experiment...er.ini
windows10-2004-x64
1experiment...er.ini
windows11-ltsc_2024-x64
1experiment...nt.dll
windows10-2004-x64
3experiment...nt.dll
windows11-ltsc_2024-x64
3experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
8experiment...er.exe
windows10-2004-x64
3experiment...er.exe
windows11-ltsc_2024-x64
3job_id
windows10-2004-x64
3job_id
windows11-ltsc_2024-x64
8linux/lobb...ct_x64
ubuntu-18.04-amd64
1linux/lobb...ct_x86
ubuntu-18.04-amd64
linux/tool...ces.sh
ubuntu-18.04-amd64
1linux/tool...ces.sh
debian-9-armhf
1linux/tool...ces.sh
debian-9-mips
linux/tool...ces.sh
debian-9-mipsel
linux/tool...der.sh
ubuntu-18.04-amd64
3linux/tool...der.sh
debian-9-armhf
3linux/tool...der.sh
debian-9-mips
linux/tool...der.sh
debian-9-mipsel
Analysis
- max time kernel
898s - max time network
552s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Readme.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Readme.txt
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
experimental/steam_api.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
experimental/steam_api.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
experimental/steam_api64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
experimental/steam_api64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
experimental/steamclient.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
experimental/steamclient.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
experimental/steamclient64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
experimental/steamclient64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
experimental_steamclient/ColdClientLoader.ini
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
experimental_steamclient/ColdClientLoader.ini
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
experimental_steamclient/steamclient.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
experimental_steamclient/steamclient.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
experimental_steamclient/steamclient64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
experimental_steamclient/steamclient64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
experimental_steamclient/steamclient_loader.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
experimental_steamclient/steamclient_loader.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
job_id
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
job_id
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
linux/lobby_connect/lobby_connect_x64
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral24
Sample
linux/lobby_connect/lobby_connect_x86
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral25
Sample
linux/tools/find_interfaces.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral26
Sample
linux/tools/find_interfaces.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral27
Sample
linux/tools/find_interfaces.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral28
Sample
linux/tools/find_interfaces.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral29
Sample
linux/tools/steamclient_loader.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral30
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral31
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral32
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-mipsel-20260513-en
General
- Target experimental_steamclient/steamclient.dll
- Size 2.3MB
- Sample260722-1bty7ace79
- SHA256 23b86547d3733d7909f4a3cf680441c166a8dccc651f30f7f44b58e5bf5ab8c1
- MD5 e87b69d973206ce2226e0c30711393db
- SHA1 a567b8584f0db304f7ffdfbbbffaf6fa4939c1b9
- SHA512 f64aff55ce1da38c702fa7922c214df55c9809373f8fd01459af0ee40d769e7c07aa5e3296cf7f3de4511396bc8a97619fd13ca833cef024de01dc502a7aee35
- SSDEEP 49152:TYVE8qed9IlFzM5V9nWewuK8/4aEAIeCZ7Y0MPXCoLy3MK+EI/h5HVXFVMiBo:EV/qesTzMHJRwuK8APAIfZ7Y0g0ahxVX
- TLSH T199B5BE22B682C0BAE29F11B17A78E76F403C65440B2406E7F3D92D6DBD610D35B7B25B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2952 wrote to memory of 4824 2952 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\experimental_steamclient\steamclient.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\experimental_steamclient\steamclient.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4824
-