Overview
overview
8Static
static
3Goldberg_L...f0.zip
windows10-2004-x64
1Goldberg_L...f0.zip
windows11-ltsc_2024-x64
1Readme.txt
windows10-2004-x64
1Readme.txt
windows11-ltsc_2024-x64
1experiment...pi.dll
windows10-2004-x64
3experiment...pi.dll
windows11-ltsc_2024-x64
8experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
1experiment...nt.dll
windows10-2004-x64
3experiment...nt.dll
windows11-ltsc_2024-x64
3experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
1experiment...er.ini
windows10-2004-x64
1experiment...er.ini
windows11-ltsc_2024-x64
1experiment...nt.dll
windows10-2004-x64
3experiment...nt.dll
windows11-ltsc_2024-x64
3experiment...64.dll
windows10-2004-x64
1experiment...64.dll
windows11-ltsc_2024-x64
8experiment...er.exe
windows10-2004-x64
3experiment...er.exe
windows11-ltsc_2024-x64
3job_id
windows10-2004-x64
3job_id
windows11-ltsc_2024-x64
8linux/lobb...ct_x64
ubuntu-18.04-amd64
1linux/lobb...ct_x86
ubuntu-18.04-amd64
linux/tool...ces.sh
ubuntu-18.04-amd64
1linux/tool...ces.sh
debian-9-armhf
1linux/tool...ces.sh
debian-9-mips
linux/tool...ces.sh
debian-9-mipsel
linux/tool...der.sh
ubuntu-18.04-amd64
3linux/tool...der.sh
debian-9-armhf
3linux/tool...der.sh
debian-9-mips
linux/tool...der.sh
debian-9-mipsel
Analysis
- max time kernel
899s - max time network
867s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Readme.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
experimental/steam_api.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
experimental/steam_api.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
experimental/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
experimental/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
experimental/steamclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
experimental/steamclient.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
experimental/steamclient64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
experimental/steamclient64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
experimental_steamclient/ColdClientLoader.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
experimental_steamclient/ColdClientLoader.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
experimental_steamclient/steamclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
experimental_steamclient/steamclient.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
experimental_steamclient/steamclient64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
experimental_steamclient/steamclient64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
experimental_steamclient/steamclient_loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
experimental_steamclient/steamclient_loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
job_id
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
job_id
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
linux/lobby_connect/lobby_connect_x64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
linux/lobby_connect/lobby_connect_x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral25
Sample
linux/tools/find_interfaces.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
linux/tools/find_interfaces.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
linux/tools/find_interfaces.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
linux/tools/find_interfaces.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
linux/tools/steamclient_loader.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral31
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral32
Sample
linux/tools/steamclient_loader.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target Readme.txt
- Size 13KB
- Sample260722-1bty7ace79
- SHA256 a49c3ddecd7af392d63f06666272970834b8f767ae0e2b310451269183a1938d
- MD5 cb9ae9be19c2ec8c6cfff3fd69dcefe1
- SHA1 57fabe1ace51a7dc6f2c89d2a4916d4e67aceb5c
- SHA512 3af5795e7cfeadfbf651aa7345ec3b6e03f58ba1a57e3c30e9a825a8c148ee0a2b3ea5d66af28f4516fd2aadd6741d306845a036f460fbbe3bdb5ba5a34c6bd0
- SSDEEP 384:onicZhpchc8hoW5vAJZ0kMdsv8F/nagN6HOyi19:ei83aaKv2ZMykNagN6uyiD
- TLSH T13152A35FF65413734220127AE28FB6DBE718C0FE52F1A431B4AD929832519E712B6DCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4808 NOTEPAD.EXE
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Readme.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3112
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:3472