Analysis
- user interaction
yes - max time kernel
10s - max time network
12s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
05/09/2026, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
SteamTools-linux
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
4 signatures
150 seconds
General
- Target SteamTools-linux
- Size 9.7MB
- Sample260905-evmtbswfrf
- SHA256 6e93bc8c6c075b840b9d8810f4e8528b6e018aef6cb3ba5dd86e49da59ab0a03
- MD5 57cee07f51eb5e75a3227510bdfb7e6e
- SHA1 720c05036ff86dcf135c7d14af8885094868637c
- SHA512 db99fe5e3cde38653f439c374aad732cd0bfb136e7e0d497111fbbd210b476484bc20df0b73463d87bfceecf89bc4d03f40854e2705826ea8995b40474a3ebc0
- SSDEEP 98304:vdmOkPJILmQc47oUIAyNFzdQmFxea6WV2w8DiQQukh5AE:aJZ89kTeNpDiV
- TLSH T1AEA66C17ECA515B8C0AE86358972A513BB71BC4D4B3123D73B68F2246F73BD0A97A344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size SteamTools-linux File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max SteamTools-linux -
description ioc Process File opened for reading /proc/1/comm SteamTools-linux File opened for reading /proc/1477/comm SteamTools-linux File opened for reading /proc/1821/cmdline SteamTools-linux File opened for reading /proc/273/cmdline SteamTools-linux File opened for reading /proc/37/cmdline SteamTools-linux File opened for reading /proc/1017/comm SteamTools-linux File opened for reading /proc/33/comm SteamTools-linux File opened for reading /proc/45/comm SteamTools-linux File opened for reading /proc/48/comm SteamTools-linux File opened for reading /proc/1673/cmdline SteamTools-linux File opened for reading /proc/70/cmdline SteamTools-linux File opened for reading /proc/sys/net/core/somaxconn SteamTools-linux File opened for reading /proc/1467/comm SteamTools-linux File opened for reading /proc/42/comm SteamTools-linux File opened for reading /proc/50/comm SteamTools-linux File opened for reading /proc/1015/cmdline SteamTools-linux File opened for reading /proc/1258/cmdline SteamTools-linux File opened for reading /proc/129/cmdline SteamTools-linux File opened for reading /proc/1665/cmdline SteamTools-linux File opened for reading /proc/1491/comm SteamTools-linux File opened for reading /proc/27/comm SteamTools-linux File opened for reading /proc/137/cmdline SteamTools-linux File opened for reading /proc/163/cmdline SteamTools-linux File opened for reading /proc/1939/cmdline SteamTools-linux File opened for reading /proc/30/cmdline SteamTools-linux File opened for reading /proc/44/cmdline SteamTools-linux File opened for reading /proc/7/cmdline SteamTools-linux File opened for reading /proc/18/comm SteamTools-linux File opened for reading /proc/1863/comm SteamTools-linux File opened for reading /proc/37/comm SteamTools-linux File opened for reading /proc/1462/cmdline SteamTools-linux File opened for reading /proc/1494/cmdline SteamTools-linux File opened for reading /proc/1668/cmdline SteamTools-linux File opened for reading /proc/995/cmdline SteamTools-linux File opened for reading /proc/self/cmdline SteamTools-linux File opened for reading /proc/1424/comm SteamTools-linux File opened for reading /proc/1505/comm SteamTools-linux File opened for reading /proc/1285/cmdline SteamTools-linux File opened for reading /proc/1498/cmdline SteamTools-linux File opened for reading /proc/20/cmdline SteamTools-linux File opened for reading /proc/1665/comm SteamTools-linux File opened for reading /proc/36/comm SteamTools-linux File opened for reading /proc/72/comm SteamTools-linux File opened for reading /proc/1069/comm SteamTools-linux File opened for reading /proc/1734/comm SteamTools-linux File opened for reading /proc/416/comm SteamTools-linux File opened for reading /proc/47/comm SteamTools-linux File opened for reading /proc/8/comm SteamTools-linux File opened for reading /proc/862/comm SteamTools-linux File opened for reading /proc/987/comm SteamTools-linux File opened for reading /proc/1265/cmdline SteamTools-linux File opened for reading /proc/1051/comm SteamTools-linux File opened for reading /proc/1682/comm SteamTools-linux File opened for reading /proc/1803/comm SteamTools-linux File opened for reading /proc/385/comm SteamTools-linux File opened for reading /proc/39/comm SteamTools-linux File opened for reading /proc/46/comm SteamTools-linux File opened for reading /proc/1375/cmdline SteamTools-linux File opened for reading /proc/140/cmdline SteamTools-linux File opened for reading /proc/389/comm SteamTools-linux File opened for reading /proc/1286/cmdline SteamTools-linux File opened for reading /proc/1635/cmdline SteamTools-linux File opened for reading /proc/1687/cmdline SteamTools-linux File opened for reading /proc/774/cmdline SteamTools-linux - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.config/steamtools/steamtools.lock SteamTools-linux File opened for modification /tmp/.steamtools/ban_marker SteamTools-linux
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.config/steamtools/steamtools.lock
- Size 89B
- SHA256 71b8fcdd3a4773d4b9093416f1023f9086ddfaaae92df83a0a99e31951fe9638
- MD5 3796004b89f8f61a5a527040484344f8
- SHA1 683a9c41b015ee147378fde61c6ddacba3cc71a6
- SHA512 5376e9af31be4c9fd99fbb9bdf2be70d0702759a797ffc4fece3ca537d312b9a32e35256670bf5ac2fe852cfe4945089ab47d7ecab6f5892a4f5f47b9b793095
- TLSH T10BB0120064E197A020431C0280A101910D33C50504503D94D58376DD04A0D320143420
- MD5 SHA1 SHA512 TLSH
- Path /tmp/.steamtools/ban_marker
- Size 64B
- SHA256 73178f3d360e8a6401e7e4fe9cebd61c61a1173ed259cc95fd97ea481ad7d690
- MD5 b8069a25fefd23a5486cf01a8d0d2b25
- SHA1 415991767eeeee0d4c94559fdb0a3e72a292da47
- SHA512 39c676c5fe797fc88e8b16570ee099161391409e78d6dc267d525054998fd3b981038057724541f6a366d18dfad0ad22d4a32fbb277f585b9485a41a03427046
- TLSH T10DA022080000A3AA08A00BCF0A08A20F0B0000038820BE0002C0CEE2038F2EC0AE3828
- MD5 SHA1 SHA512 TLSH