caf2258f97a543df27d25118898f8b6a038eed5a1191be5be7df6fb5ccb66826

Analysis

max time kernel
0s
max time network
897s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linux/tools/steamclient_loader.sh
Size 1KB
Sample260722-1bty7ace79
SHA256 caf2258f97a543df27d25118898f8b6a038eed5a1191be5be7df6fb5ccb66826
MD5 56e4669fc11da6c722e14832c833ee34
SHA1 82992963c3fc41706a8c66885f6c88777eddc1a3
SHA512 ebf21ca112e0abe773857d280c879d244462b503c5eff6dd5896d12e0aa638dbe22ef4b2c2096299fb7fa3cfcb10666306a93452cb53dfc9a9165ddda46b1ce8
TLSH
T12521D4AE8E929938A31C8740EB4081BFFFF14A374513F51DA0E8938E471AB545729E2D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv

/tmp/linux/tools/steamclient_loader.sh
/tmp/linux/tools/steamclient_loader.sh
1⤵
PID:1478
- /usr/bin/dirname
  dirname /tmp/linux/tools/steamclient_loader.sh
  2⤵
  PID:1479
- /usr/bin/dirname
  dirname /tmp/linux/tools/steamclient_loader.sh
  2⤵
  PID:1480
- /bin/mkdir
  mkdir -p /root/.steam/sdk64
  2⤵
  - Reads runtime system information
  PID:1482
- /bin/mkdir
  mkdir -p /root/.steam/sdk32
  2⤵
  - Reads runtime system information
  PID:1483
- /bin/mv
  mv /root/.steam/steam.pid /root/.steam/steam.pid.orig
  2⤵
  - Reads runtime system information
  PID:1484
- /bin/mv
  mv /root/.steam/sdk64/steamclient.so /root/.steam/sdk64/steamclient.so.orig
  2⤵
  - Reads runtime system information
  PID:1485
- /bin/mv
  mv /root/.steam/sdk32/steamclient.so /root/.steam/sdk32/steamclient.so.orig
  2⤵
  - Reads runtime system information
  PID:1486
- /bin/cp
  cp x86/steamclient.so /root/.steam/sdk32/steamclient.so
  2⤵
  - Reads runtime system information
  PID:1487
- /bin/cp
  cp x86_64/steamclient.so /root/.steam/sdk64/steamclient.so
  2⤵
  - Reads runtime system information
  PID:1488
- /tmp/linux/tools/bin/test_executable
  bin/test_executable
  2⤵
  PID:1489
- /bin/rm
  rm -f /root/.steam/steam.pid
  2⤵
  PID:1490
- /bin/rm
  rm -f /root/.steam/sdk64/steamclient.so
  2⤵
  PID:1491
- /bin/rm
  rm -f /root/.steam/sdk32/steamclient.so
  2⤵
  PID:1492
- /bin/mv
  mv /root/.steam/steam.pid.orig /root/.steam/steam.pid
  2⤵
  - Reads runtime system information
  PID:1493
- /bin/mv
  mv /root/.steam/sdk64/steamclient.so.orig /root/.steam/sdk64/steamclient.so
  2⤵
  - Reads runtime system information
  PID:1494
- /bin/mv
  mv /root/.steam/sdk32/steamclient.so.orig /root/.steam/sdk32/steamclient.so
  2⤵
  - Reads runtime system information
  PID:1495

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads