70580f9fa8445de1d8afdd75d3395c93adc5260a63098cdd658a90466379f7fc | Triage™

Login
Reports

Overview

overview

3

Static

static

3

MSVCR71.dll

windows10-2004-x64

3

MSVCR71.dll

windows11-ltsc_2024-x64

3

emulator.exe

windows10-2004-x64

3

emulator.exe

windows11-ltsc_2024-x64

3

files/SteamUI_273.pkg

macos-10.15-amd64

files/Steam_21.pkg

macos-10.15-amd64

files/firstblob.py

windows10-2004-x64

3

files/firstblob.py

windows11-ltsc_2024-x64

3

files/secondblob.py

windows10-2004-x64

3

files/secondblob.py

windows11-ltsc_2024-x64

3

files/user...est.py

windows10-2004-x64

3

files/user...est.py

windows11-ltsc_2024-x64

3

fixed_exe/Steam.exe

windows10-2004-x64

3

fixed_exe/Steam.exe

windows11-ltsc_2024-x64

3

python24.dll

windows10-2004-x64

3

python24.dll

windows11-ltsc_2024-x64

3

source/Ste...est.py

windows10-2004-x64

3

source/Ste...est.py

windows11-ltsc_2024-x64

3

source/emulator.py

windows10-2004-x64

3

source/emulator.py

windows11-ltsc_2024-x64

3

source/setup.py

windows10-2004-x64

3

source/setup.py

windows11-ltsc_2024-x64

3

source/steam.py

windows10-2004-x64

3

source/steam.py

windows11-ltsc_2024-x64

3

source/ste...ver.py

windows10-2004-x64

3

source/ste...ver.py

windows11-ltsc_2024-x64

3

source/ste...fig.py

windows10-2004-x64

3

source/ste...fig.py

windows11-ltsc_2024-x64

3

source/ste...ver.py

windows10-2004-x64

3

source/ste...ver.py

windows11-ltsc_2024-x64

3

source/ste...ver.py

windows10-2004-x64

3

source/ste...ver.py

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
steam_content_emu_poc.rar
Size 11.6MB
Sample260823-ecafaaxtey
SHA256 70580f9fa8445de1d8afdd75d3395c93adc5260a63098cdd658a90466379f7fc
MD5 381f36c37f09c03474531fe7e3a8abe3
SHA1 1d82671689ed53d5953d7fcb4e9ae20ab3b7d631
SHA512 e8954b8161dd5bf9022bed201e6ab4a50348230ddc25f60b38d75be43207596dcb1d3acc81a7397516895919e84852024efc1da6163bb4587592824324b77f70
SSDEEP 196608:QWve1XjofWKlaMvujEpTmNvrgiKDRVn0j7IkWN+KiFKOxZxpa6dHtIdOMGROvsp:QW0XjXKbmjEpcHEVnmk3N+jFKOTxoQag
TLSH
T1E5C6336CC91DA12BC5640CF0455DFABCFAE1211F67922B2809BBB45E65F6C40DB0E9F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution macos

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

MSVCR71.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

MSVCR71.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

emulator.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

emulator.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

files/SteamUI_273.pkg

Resource

macos-20250619-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

files/Steam_21.pkg

Resource

macos-20250619-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

files/firstblob.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral8

Sample

files/firstblob.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

files/secondblob.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

files/secondblob.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral11

Sample

files/users/steamtest.py

Resource

win10v2004-20260513-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral12

Sample

files/users/steamtest.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral13

Sample

fixed_exe/Steam.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

fixed_exe/Steam.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

python24.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

python24.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

source/Steam2/manifest.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

source/Steam2/manifest.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

source/emulator.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

source/emulator.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

source/setup.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral22

Sample

source/setup.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral23

Sample

source/steam.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral24

Sample

source/steam.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

source/steamemu/authserver.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral26

Sample

source/steamemu/authserver.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral27

Sample

source/steamemu/config.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral28

Sample

source/steamemu/config.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral29

Sample

source/steamemu/configserver.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

source/steamemu/configserver.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

source/steamemu/contentlistserver.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

source/steamemu/contentlistserver.py

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  MSVCR71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- TLSH
  T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  emulator.exe
- Size 17KB
- SHA256 5f010c9cecd1fce7a780867b2d72afd219317c873626810618812534f76f49e1
- MD5 84e989e173e85879e526fb6684aa537a
- SHA1 cf3c1d22322b4988342ccb0ad0f7053e76310d93
- SHA512 7bedf34d7aa161496f2bd02b1520e4893378827038d09387f1a98651a6ea2a1fc89bbc41841dc8173dece72d1685e3f0ff295a21b8505dbd35ae16adb82fd34f
- SSDEEP 384:77eu6gkCClf/1SWJ+IXLBVFBVXTbSsrL2RjPWehd6T5hDda4H/2:77eu6ECJ1SqBVFBVXHSJhWehdAnDdfu
- TLSH
  T13C72F9866FD09C6BE3A4453542E9466F8B33F3B3A31199D3CA2C697619942C4CD7C3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  files/SteamUI_273.pkg
- Size 6.9MB
- SHA256 644ea6f25a07b4696095aaf908a6b5a60fcd65f2e417361cb91cd1234c5364e6
- MD5 20f17de35ce6c4ec66cb85c5c536edfa
- SHA1 679083ae255ea8983650f986e2b7c425debc9290
- SHA512 12bfc730c448af75083bd182f0ab89e6dd94bd606e2cc53a4e31bd2e8fa7c0af5353691a612a421eb82c7b8285c1dff58f5d12a9febbc70fa28a93e830678585
- SSDEEP 196608:IvId69x30i520V+VjYBUoKvsDa9jx9bv9rT:IAjYBKku9vRT
- TLSH
  T1C8763321F9615B48EDBF8675BE5E1C9818F3E33885727C5CA23970064C2ED18A934F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  files/Steam_21.pkg
- Size 539KB
- SHA256 178dd2de26fc4dd08025ffc9ef9dc3df8fecc33f82e6a1ffa3d76a45551a6e07
- MD5 6bd6e3d30d746ec4d8a7e23849d6847f
- SHA1 da830b551f27ed37e5bc538225d4ce7147b1e204
- SHA512 d3f4d235df87da484f44756d775251c4e7dc5d935970a27d855793d67176776b9dd6625a117faa69d92214fb71853bf53e8fd6577ac58272fbabab20e31ddd1a
- SSDEEP 12288:xj+6eXA4bauEBvZmg2HZHJQSd3XEIq7pNVTwBpoLLQNz9:xjLeXARvgXHvQSdQlTwfNJ
- TLSH
  T1FDC4234FEF380BD7A8BBD749EFBC0F54816A769AD08215652FB4052FD081EE448B5B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  files/firstblob.py
- Size 762B
- SHA256 4e0865a3231f5b42c3f0d5091801f5f71b180d4f74a242143df4c68dbf9d5966
- MD5 5f822ce004da2d1cc6d5e646c286e8e0
- SHA1 cd6a6c29bbb9bc9fab285f4f39adc49080fe8de5
- SHA512 dd57964c293907ab0132057bd69466f1c25e0572dd31c1915f18bffcf877be328a34d132936147f4ff4e89a6425a4b471fd559a6400821761efce2a7d02c49d9
- TLSH
  T15F01D4C34DA78E290AB5D90AAD343D6CAE5C83A7C6472F82B5F89007EBF061380C4470
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  files/secondblob.py
- Size 2.9MB
- SHA256 8bb131dea6334f2605717aa5ea2333eab2d7233a9a3674f92654ee2b6129a785
- MD5 0a0abf761d30b154b30e9f83c56fff46
- SHA1 0fc46d506ae06429f2c6ab653e24e253b1fa568c
- SHA512 2b41eef1a110b4c3f627bcb9c7b2fa5127d9ab70bd4e89d1c8180a7497a7ec1a0b07b68b230baa82981d2bb3f49d6d0f23a26e1d44d33e68e63b457c9a99d307
- SSDEEP 1536:Dili8MxUCOQPmhUqZuSo5xfiuRJNrlEgvKwMfsuc66pudub3EIVu2w/:Wl4YbUqcJNrlEgvKYpu0EIVu2q
- TLSH
  T175E59AD70CA35A6A06F5D61AAD387D6CEE0C87ABD4872F8276BCA517DFF16034080935
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  files/users/steamtest.py
- Size 2KB
- SHA256 cf62d7e915fb5c623f9d1cf5ec98205e3ecdff73ee38895d1c94af5e08bbf58e
- MD5 ef6b32579c1e58cc2ab29f868d301f04
- SHA1 13ca61fb44acf41579dcfab187a1c1c44317c06d
- SHA512 1a0b99c376cee2e52b3de5ae4e408356b7c1a37037ab9f2a84002174ab87ecdb80779ce32fefd01147ded001188e4d8f56b227fd8a4bd91668d29ed0bb508185
- TLSH
  T149512AC70CA30A2526F5D61AAD3A7D2CEE1D479798C72F8276BC9503CFF12230280929
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  fixed_exe/Steam.exe
- Size 1.2MB
- SHA256 c7ff6fcec1aa978dba05fe95572e1354149d3e889a0d3293fc980f1b485fbc3a
- MD5 7b424e35e502cd92104277f8c0b7ed4b
- SHA1 b9eec9b07247edac6467a2cf6993d8bf5b6c6992
- SHA512 2a9dc0a0119e6ea3a9d2af4e20335aa83074735436b997c82e71846b3ba3ab0a923236bd5797ad0673c5401a4035e3dc44c7f7ea87c4547fed65d2268aa556b6
- SSDEEP 24576:PVC1vz33ISg0Qdii2Rg+uAvTlx/xItDtIXGiyLUt:PVC1vc0QdiPRvuAOtmGiyLW
- TLSH
  T1C0455921B6E3C076D69214380B7FE779527DBF854F219EC7B3B8EA1C597A2C04436229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  python24.dll
- Size 1.8MB
- SHA256 6db17fd717e0fe72f5da76923ca29ace799b0b861dd0e3024928953d33a36b60
- MD5 504854548a67fcc1383d841ecea5f075
- SHA1 a811fa7e0b6c8169bec4b2aed7513ad7ec2e7b1b
- SHA512 359c1d802aa2d553b360de413d6e30c05a3cf2a7afe4e0190ff1179eec41fc08fd3c1a9aee2a13ab11233307d8557ed8a9ae66189275adcde75f9e34aa979461
- SSDEEP 24576:WwVON0FoSNYuEZeh1BNbi/yhOSjj3e/74ulduIagdl/hmNNffHvSznmM+PlxzHIv:L1ve/yhOzNRaFNhfHvCnmM+PlxU4fZ
- TLSH
  T169857C45F7828575C49585BD53B76E7A7A375E72232FF4E3CA2439808B321E0873E289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  source/Steam2/manifest.py
- Size 1KB
- SHA256 b5232210eaf1dc3864577ee5af04ea24e85da212bdb2a9439532e69ddd3facff
- MD5 d3ecad2b416999c2e0efa15fadf5e756
- SHA1 0a6d9510e29b8ddd3a144d506f9d3d24061378c4
- SHA512 af4b727ef9304ce24a3e36ba0853b7f6e581eb59e9f0c10034df72f97fb860be896869e0cb0631db8dd58e36836b1da33b65e19001df8eefffd6992f26977ee5
- TLSH
  T1AE316829594F44559733EE2A94D93E9BC78F1A07160F141A39BDB2806FB012232F8DF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  source/emulator.py
- Size 1KB
- SHA256 0ca23623fcd88cf5ef98a88809eea8e6666f4d7ec2d48fdea68638300dfcae9a
- MD5 acf6dd7a007d31f9abc25941f77f4fae
- SHA1 7696c3be0d78ac1d0a359dc15365f5e4ea5d0fa7
- SHA512 1bbb50dbb0b706365e79f1ac01fd87514f61b2ecf5f3cd7e5e5c5adb49cde3c8a97eee041fe82f100b8cfdb353e3cb373c8930d2778e5c6ff8fccd263fe1e6c8
- TLSH
  T115411803887DA96F13A6CF53E00A97526B1EABCB170C511872FCD6D72B47C288196CA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  source/setup.py
- Size 173B
- SHA256 5de38927ea7e81a9863ae9359a2939105e4a6afec859b98ad0799e3200ef55a3
- MD5 bf34e01198a9508dd697881ef13d1b12
- SHA1 161d66852993c24d3552339ae61517ed5f47f138
- SHA512 f704cb5aa6b13200949be0e6fae0e9715dae3147ff2facc4534150ef1522672f914180ea727333e9dce5aacc7156672eff2dc50eb3a794b8d3e6b55733d55ae9
- TLSH
  T16BC0C0570CD1841125F0F0FC0E07016FAED1A3007734B2C3B23C435D0BE4C80C984001
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  source/steam.py
- Size 33KB
- SHA256 4dfed66318d512035f61b44d8afa503828da718e932218013556d29e6282cdc5
- MD5 15d86f74dc5c6cffb480fbb7d3808626
- SHA1 5c553b08982d37a5cf3e25750c830554657740cc
- SHA512 33c8f3641fe8fed9a5fed74a13766fa8144e1864a359aa10b014abc06eae354bda2697f7d7fe21c1e5a47c8095debbac2811f9ca95b2bdaf7add2428e7b504a1
- SSDEEP 768:oS/BOBbtdAoSKoFDMOMr043Q2eG82IGtKlZyKkCER3rolNlQLy://M0MRV3SG82IGtEAolNlQLy
- TLSH
  T1ADE294426D7628859703906FA4D6B4136B2B369F131C9E617AEC52E46F8403897F2FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  source/steamemu/authserver.py
- Size 6KB
- SHA256 d59ea4f46a07936d28cfffbf2b1b6554670f5e4e80c76789623f01ce412c984b
- MD5 3009d75bd4a9cbd6e8ae1470bf6e9b68
- SHA1 fd79284a18bc022312d8a62ab77004dba23d9020
- SHA512 7c534407887afcbc93029b17347b957c4d0233ff86c41a65bff6dbf72cabf193d7ebf865eb073f030478a3b83571b407633f1bbe64a22ae041a6ffb85b723903
- SSDEEP 96:jTN3K98Mzb2zkMinZltlyBC4DlWkKEc0Ojs0T0YyQgWLRu9wTTp7Gxiab3o5D5Aw:AGmb2zninjyBrDjQQC/Wias5GUCI
- TLSH
  T19AE15202EEBF4C93635749ADC461E0026AB71B4303540E22B77DABC85F9553887F0DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  source/steamemu/config.py
- Size 219B
- SHA256 4c9b774a73d6b54f70c19ccb3fc43f6e4b755a8a8e09b9e42d79a01809d2c6f1
- MD5 91bb06338a9f5a3516d3ca072a5c06b3
- SHA1 aa344459711675ca0741dac48aff87ac9e92be0b
- SHA512 b500b45d1e92406200e97bea305b7e6d358cc527107f6e5a1618b243bf9673f46a72ffe061018a8be8ce26dc9d0ea94101a447185cb2485d0cdf221c43a18d22
- TLSH
  T120D0A71FAC89144B052505C9CE5FA9196EE413139001D8CC3A8CB5406F2DC1D8024548
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  source/steamemu/configserver.py
- Size 3KB
- SHA256 04b4c4c5fac433f1cec8563debe89fbb239304b4d875beffcd0ad84a1d84b48c
- MD5 9c8303f06f3001131b59b52433f4dd52
- SHA1 7195dce17f00f6f8e8074fd94ed1a9630974efef
- SHA512 ab9ca75af22352ba11ac4b092d31fdab3c62099a023133417b2acb420d9b2b7962b48c2d3f1484faec95a4fa4d30ee25767bb780e1eeb3434b57cb0aeef29b2d
- TLSH
  T13581CD1387EF00A3523B855DC097F0027A37169723155A6E776CAFD9BF5846483B1CBA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  source/steamemu/contentlistserver.py
- Size 2KB
- SHA256 e61ed8e170171dd2e7633c86121de1144585f9da7a7db020835d6148dae1b500
- MD5 e19f742d6c3f7c620c0bdac99ae65899
- SHA1 9540580344f1ee920a929db5cab1e1432ef5e4a0
- SHA512 95bca5b8e2ab2b4043f8d34c6de04170efd958e914cf0a009d33c217705f8a4fcc16ca4c65b03f1880e9895729a9f63bf84af8584f86addf89ebcfa420118901
- TLSH
  T1BA41231386EE0057E267CE59C0627402773F7BA702D90516366C65D97FA04B482F2DE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy