steam-account-manager[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
steam-account-manager.exe
Size 6.3MB
Sample260809-ver14sbe27
SHA256 acc101992d51981df94c53a99d5913689b21cfba2786a553c7958d65aaca9d15
MD5 278c3e93d9a7c1d36963c5d0e2696f3e
SHA1 8ba2fd328e025fea19f53403c77a3a11ed70c86d
SHA512 ae24f7212fc67e75e2d696ff393787ec7a34030d6492a3c40efe31d8c912d7d3773418da76f00720515907833b8ca322aa05e84d0f332cbbbe8addb6a30c26f0
SSDEEP 98304:+Dei7DUm9nHmTjKHnZaX1771D/zs+Y7uMli9cSU5rj:MeC99nHmTjKHnZaX1771TzhYyHKh
TLSH
T1D5668D26A6A401ECD0BBE179CE4AD903EB72B80507719BDF06A046665F776E05F3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
steam-account-manager.exe

File Explorer

steam-account-manager.exe

.exe 6.3MB

steam-account-manager.exe

IMPHASH 368e9f2624040218bb04333c64c25a24
SHA256 acc101992d51981df94c53a99d5913689b21cfba2786a553c7958d65aaca9d15
MD5 278c3e93d9a7c1d36963c5d0e2696f3e
SHA1 8ba2fd328e025fea19f53403c77a3a11ed70c86d
SHA512 ae24f7212fc67e75e2d696ff393787ec7a34030d6492a3c40efe31d8c912d7d3773418da76f00720515907833b8ca322aa05e84d0f332cbbbe8addb6a30c26f0
SSDEEP 98304:+Dei7DUm9nHmTjKHnZaX1771D/zs+Y7uMli9cSU5rj:MeC99nHmTjKHnZaX1771TzhYyHKh
TLSH
T1D5668D26A6A401ECD0BBE179CE4AD903EB72B80507719BDF06A046665F776E05F3F312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4039056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\steam-account-manager\steam-account-manager\build\Release\steam-account-manager.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData CryptProtectData

advapi32

RegDeleteValueW RegQueryValueExA RegOpenKeyExA GetUserNameW RegDeleteTreeW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW OpenProcessToken RegQueryValueExW RegGetValueW SetEntriesInAclW SetNamedSecurityInfoW GetTokenInformation

shell32

Shell_NotifyIconW ShellExecuteExW SHGetKnownFolderPath ShellExecuteW DragFinish DragAcceptFiles DragQueryFileW

ole32

PropVariantClear CoInitializeEx CoTaskMemFree CoSetProxyBlanket CoUninitialize CoInitializeSecurity CoCreateInstance

oleaut32

VariantInit SysFreeString SysStringLen SysAllocStringLen VariantClear SysAllocString

user32

GetWindowThreadProcessId IsWindowVisible EnumWindows DefWindowProcW PostMessageW GetWindowRect DestroyWindow SetWindowPos GetDpiForWindow CreateWindowExW UnregisterClassW MsgWaitForMultipleObjects RegisterClassExW ShowWindow DispatchMessageW PeekMessageW EnumDisplayDevicesW IsIconic SetForegroundWindow PostQuitMessage IsZoomed GetSystemMetricsForDpi LoadCursorW ChangeWindowMessageFilterEx FindWindowW LoadIconW GetWindowTextW GetWindowLongW AdjustWindowRectEx GetKeyState GetMessageExtraInfo SetPropA MonitorFromWindow SetWindowLongPtrW EnumDisplayMonitors ScreenToClient WindowFromPoint GetCapture GetMonitorInfoW ClientToScreen IsChild TrackMouseEvent GetKeyboardLayout GetPropA SetLayeredWindowAttributes SetFocus BringWindowToTop SetCapture SetCursor SetWindowLongW GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetClipboardData GetSystemMetrics SendInput EnumDisplaySettingsW GetDC GetIconInfo DestroyIcon LoadImageW ReleaseDC SetWindowDisplayAffinity GetForegroundWindow UnregisterHotKey RegisterHotKey OpenClipboard CloseClipboard EmptyClipboard GetClipboardSequenceNumber SetClipboardData GetWindowTextLengthW IsWindow TranslateMessage

gdi32

GetDeviceCaps DeleteObject GetDIBits GetObjectW

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htonl getsockopt recv connect ntohs socket send getsockname WSAStartup getaddrinfo listen shutdown closesocket select accept __WSAFDIsSet bind

winhttp

WinHttpWebSocketCompleteUpgrade WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpWebSocketReceive WinHttpSetOption WinHttpOpenRequest WinHttpWebSocketSend WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders

kernel32

SetStdHandle SetFilePointerEx GetFileSizeEx GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ExitProcess GetConsoleOutputCP ReadConsoleW SetEnvironmentVariableW ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind HeapReAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetTickCount64 GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW DeviceIoControl SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW RaiseException Process32NextW SetLastError GetCurrentDirectoryW FindClose FindNextFileW FindFirstFileW GetSystemTimeAsFileTime QueryPerformanceCounter FreeLibrary VerSetConditionMask IsDBCSLeadByte QueryPerformanceFrequency GetLocaleInfoA GetModuleHandleA GetComputerNameA GlobalMemoryStatusEx GetSystemFirmwareTable GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA WriteFile GetModuleFileNameW GetDynamicTimeZoneInformation GetCurrentThreadId Sleep GetConsoleMode CloseHandle GetCurrentProcessId CreateProcessW OutputDebugStringA IsDebuggerPresent MultiByteToWideChar GetLastError WideCharToMultiByte CreateToolhelp32Snapshot HeapSize Process32FirstW GetCurrentProcess RemoveDirectoryW CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW LocalFree MoveFileExW FlushFileBuffers TerminateProcess WaitForSingleObject OpenProcess GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryW GetProcAddress GetModuleHandleW CreateMutexW ReleaseMutex lstrcpynW SizeofResource LockResource LoadResource FindResourceW UnmapViewOfFile CreateFileMappingA MapViewOfFile WriteProcessMemory RtlAddFunctionTable LoadLibraryA VirtualProtectEx VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetExitCodeProcess

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

138KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

354KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

steam-account-manager.exe

d3d11

dxgi

d3dcompiler_47

dwmapi

bcrypt

crypt32

advapi32

shell32

ole32

oleaut32

user32

gdi32

ws2_32

winhttp

kernel32

secur32

iphlpapi

imm32

generic