caf2258f97a543df27d25118898f8b6a038eed5a1191be5be7df6fb5ccb66826

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linux/tools/steamclient_loader.sh
Size 1KB
Sample260722-1bty7ace79
SHA256 caf2258f97a543df27d25118898f8b6a038eed5a1191be5be7df6fb5ccb66826
MD5 56e4669fc11da6c722e14832c833ee34
SHA1 82992963c3fc41706a8c66885f6c88777eddc1a3
SHA512 ebf21ca112e0abe773857d280c879d244462b503c5eff6dd5896d12e0aa638dbe22ef4b2c2096299fb7fa3cfcb10666306a93452cb53dfc9a9165ddda46b1ce8
TLSH
T12521D4AE8E929938A31C8740EB4081BFFFF14A374513F51DA0E8938E471AB545729E2D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv

/tmp/linux/tools/steamclient_loader.sh
/tmp/linux/tools/steamclient_loader.sh
1⤵
PID:716
- /usr/bin/dirname
  dirname /tmp/linux/tools/steamclient_loader.sh
  2⤵
  PID:718
- /usr/bin/dirname
  dirname /tmp/linux/tools/steamclient_loader.sh
  2⤵
  PID:720
- /bin/mkdir
  mkdir -p /root/.steam/sdk64
  2⤵
  - Reads runtime system information
  PID:724
- /bin/mkdir
  mkdir -p /root/.steam/sdk32
  2⤵
  - Reads runtime system information
  PID:725
- /bin/mv
  mv /root/.steam/steam.pid /root/.steam/steam.pid.orig
  2⤵
  - Reads runtime system information
  PID:728
- /bin/mv
  mv /root/.steam/sdk64/steamclient.so /root/.steam/sdk64/steamclient.so.orig
  2⤵
  - Reads runtime system information
  PID:729
- /bin/mv
  mv /root/.steam/sdk32/steamclient.so /root/.steam/sdk32/steamclient.so.orig
  2⤵
  - Reads runtime system information
  PID:733
- /bin/cp
  cp x86/steamclient.so /root/.steam/sdk32/steamclient.so
  2⤵
  - Reads runtime system information
  PID:736
- /bin/cp
  cp x86_64/steamclient.so /root/.steam/sdk64/steamclient.so
  2⤵
  - Reads runtime system information
  PID:739
- /tmp/linux/tools/bin/test_executable
  bin/test_executable
  2⤵
  PID:741
- /bin/rm
  rm -f /root/.steam/steam.pid
  2⤵
  PID:742
- /bin/rm
  rm -f /root/.steam/sdk64/steamclient.so
  2⤵
  PID:744
- /bin/rm
  rm -f /root/.steam/sdk32/steamclient.so
  2⤵
  PID:745
- /bin/mv
  mv /root/.steam/steam.pid.orig /root/.steam/steam.pid
  2⤵
  - Reads runtime system information
  PID:747
- /bin/mv
  mv /root/.steam/sdk64/steamclient.so.orig /root/.steam/sdk64/steamclient.so
  2⤵
  - Reads runtime system information
  PID:749
- /bin/mv
  mv /root/.steam/sdk32/steamclient.so.orig /root/.steam/sdk32/steamclient.so
  2⤵
  - Reads runtime system information
  PID:751

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads