Jump to content

steam hacked?

SAV1OUR
By SAV1OUR
in Off Topic
 Share
Posted (edited)

So after some further inspection, this seems to be some variant of SteamStealer.

It's written in C# using the .NET framework.

 

It seems to latch itself onto steam memory and read various files and memory regions inside Steam.

It's used to trade valuable items to the programmer

 

 

See my dissection of this malware on page 3.

Reboot, delete the img_012.scr file and look for any missing items on steam.

 

The virus doesn't infect your system or other files; once it's stolen your items and sent the message, it's done.

post-93043-0-64401500-1416003618.png

post-93043-0-35936400-1416003722.png

Edited by JvHummel
Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Well could some one for the sake of science run a vm and see what it does?

don't have linux :x 

Specs

CPU: i5 4670k i won the silicon lottery Cooler: Corsair H100i w/ 2x Corsair SP120 quiet editions Mobo: ASUS Z97 SABERTOOTH MARK 1 Ram: Corsair Platnums 16gb (4x4gb) Storage: Samsun 840 evo 256gb and random hard drives GPU: EVGA acx 2.0 gtx 980 PSU: Corsair RM 850w Case: Fractal Arc Midi R2 windowed 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

well i found somthing else weird, all my friends list says last online 3hrs ago, yet half of use were in school

My Rig  

 
PCPartPicker part list: http://ca.pcpartpicker.com/p/kGNksY

 

CPU: Intel Core i7-4770 3.4GHz Quad-Core Processor  ($379.00 @ shopRBC) 

CPU Cooler: RAIJINTEK THEMIS 65.7 CFM Sleeve Bearing CPU Cooler  ($34.99 @ NCIX) 

Motherboard: MSI CSM-H87M-G43 Micro ATX LGA1150 Motherboard  ($78.83 @ DirectCanada) 

Memory: Kingston HyperX 16GB (4 x 4GB) DDR3-1600 Memory  ($139.99 @ Memory Express) 

Storage: Kingston Fury 120GB 2.5" Solid State Drive  ($71.34 @ DirectCanada) 

Storage: Seagate Barracuda 2TB 3.5" 7200RPM Internal Hard Drive  ($92.95 @ Vuugo) 

Video Card: Gigabyte Radeon R9 280X 3GB Video Card  ($298.98 @ Newegg Canada) 

Case: Fractal Design Define R4 w/Window (Black Pearl) ATX Mid Tower Case  ($125.98 @ Newegg Canada) 

Power Supply: Corsair CX 600W 80+ Bronze Certified Semi-Modular ATX Power Supply  ($66.99 @ NCIX) 

Operating System: Microsoft Windows 8.1 - 64-bit (OEM) (64-bit)  ($116.00 @ shopRBC) 

Case Fan: Cougar Turbine 120 (4-Pack) 60.4 CFM 120mm  Fans  ($23.99 @ NCIX) 

Monitor: HP 22xi 60Hz 21.5" Monitor  ($187.11 @ Amazon Canada) 

Monitor: HP 22xi 60Hz 21.5" Monitor  ($187.11 @ Amazon Canada) 

Keyboard: Logitech G710 Wired Gaming Keyboard  ($114.99 @ NCIX) 

Mouse: Razer DeathAdder 2013 Wired Optical Mouse  ($76.99 @ Amazon Canada) 

Headphones: Kingston HyperX Cloud Pro Headset  ($78.98 @ DirectCanada) 

Total: $2074.22

Prices include shipping, taxes, and discounts when availableGenerated by PCPartPicker 2015-04-10 15:33 EDT-0400Build log http://linustechtips.com/main/topic/303263-the-dell-from-hell/#entry4121100 

Phone Compassion Spreadsheet https://docs.google.com/spreadsheets/d/1EN6s426gyxqPloIqT4wQ7Y7yovkkQy_5B3djVN-N-R8/edit#gid=0


Gta V Pc Online Crew http://linustechtips.com/main/topic/344773-unofficial-linus-tech-tips-gta-v-crew-pc/

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

VampireKid is running it right meow

post updates please 

Specs

CPU: i5 4670k i won the silicon lottery Cooler: Corsair H100i w/ 2x Corsair SP120 quiet editions Mobo: ASUS Z97 SABERTOOTH MARK 1 Ram: Corsair Platnums 16gb (4x4gb) Storage: Samsun 840 evo 256gb and random hard drives GPU: EVGA acx 2.0 gtx 980 PSU: Corsair RM 850w Case: Fractal Arc Midi R2 windowed 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

The funniest thing is that whomever compiled this variant, being the butt-wipe they are, forgot the fact that Visual Studio leaves in various environment data of the compiling system.

AKA, you can thank a certain Alex Star for this.

looks like a real dweeb from google images :P but i still had guard active after running it so it didn't change it is there any last things i should do? 

Specs

CPU: i5 4670k i won the silicon lottery Cooler: Corsair H100i w/ 2x Corsair SP120 quiet editions Mobo: ASUS Z97 SABERTOOTH MARK 1 Ram: Corsair Platnums 16gb (4x4gb) Storage: Samsun 840 evo 256gb and random hard drives GPU: EVGA acx 2.0 gtx 980 PSU: Corsair RM 850w Case: Fractal Arc Midi R2 windowed 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Anyone sniffed it's packets? Me and @VampireKid did it and I didn't see anything unusual...

scroll up? @ has been looking around in its files 

Specs

CPU: i5 4670k i won the silicon lottery Cooler: Corsair H100i w/ 2x Corsair SP120 quiet editions Mobo: ASUS Z97 SABERTOOTH MARK 1 Ram: Corsair Platnums 16gb (4x4gb) Storage: Samsun 840 evo 256gb and random hard drives GPU: EVGA acx 2.0 gtx 980 PSU: Corsair RM 850w Case: Fractal Arc Midi R2 windowed 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Anyone sniffed it's packets? Me and @VampireKid did it and I didn't see anything unusual...

It latches onto steam, so it's steam's packets you'd want to be sniffing. I don't have a VM set up right now and don' exactly feel like letting it have my only steam account either :P

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

post updates please 

 

@ seems to be finding a lot more info about it the only thing i know about it that it only seems to be interested in steam


- teamspeak.ltt-unofficial.com

- teamspeak.ltt-unofficial.net

- teamschnitzel.ltt-unofficial.com

- teamschnitzel.ltt-unofficial.net



cpu: Intel sandybridge-E 3930k @ 4.2Ghz

cooler: corsair h100 @ full speed push-pull

motherboard: Asus Rampage IV Extreme

gpu: 2x EVGA GTX660's & 1x EVGA GTX980

ssd: 2x samsung 256GB 840 pro raid 0

ssd: 1x samsung 1TB 840 evo

hdd: WD green 3TB

hdd: Seagate Barracuda 1TB (st1000dm003)

hdd: Seagate Barracuda 1TB (st31000520as)

psu: corsair ax1200i

ram: 8x 4GB corsair platinum @1866mhz

case: coolermaster cosmos II

age: Do the math (summer 2012)

monitors Main: 8x LG 22EA53 1080p 60hz

monitor Extra: 1xiiyama prolite G2773Hs 1080p 120hz 27"

os: windows 7 pro (64-bit)

keyboard: logitech g19

mouse: corsair m60

 


Lenovo T550

 


RaspBerry pi webserver:

Status: Offline.

 

Nas:

Status: Offline.

 


PC straight to the modem/router/switch/DHCP-Server/... with a 20cm (+-8inch) cat6a patch cable because same price as cat5.

ISP: Telenet (belgium)

Speed: 60Down-4Up (+- 45€/month)

ping to there servers: +-8ms

ping to other Belgians: +-12ms

 

 



- wheels for cosmos II


 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

@ seems to be finding a lot more info about it the only thing i know about it that it only seems to be interested in steam

well i changed my steams password so oi guess i can relax unless its already added its self into steam somehow 

Specs

CPU: i5 4670k i won the silicon lottery Cooler: Corsair H100i w/ 2x Corsair SP120 quiet editions Mobo: ASUS Z97 SABERTOOTH MARK 1 Ram: Corsair Platnums 16gb (4x4gb) Storage: Samsun 840 evo 256gb and random hard drives GPU: EVGA acx 2.0 gtx 980 PSU: Corsair RM 850w Case: Fractal Arc Midi R2 windowed 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

interesting, it also saves it self as a screensaver.

 

9d4714c541.png

Someone told Luke and Linus at CES 2017 to "Unban the legend known as Jerakl" and that's about all I've got going for me. (It didn't work)

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

damn, I just keep getting these weirdo's that want me to join their trading networks... not as interesting as actual malware mules  <_<

R9 3900XT | Tomahawk B550 | Ventus OC RTX 3090 | Photon 1050W | 32GB DDR4 | TUF GT501 Case | Vizio 4K 50'' HDR

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

It latches onto steam, so it's steam's packets you'd want to be sniffing. I don't have a VM set up right now and don' exactly feel like letting it have my only steam account either :P

i can give you teamviewer access into that vm so you can take a look

theres also a fake steam account on there


- teamspeak.ltt-unofficial.com

- teamspeak.ltt-unofficial.net

- teamschnitzel.ltt-unofficial.com

- teamschnitzel.ltt-unofficial.net



cpu: Intel sandybridge-E 3930k @ 4.2Ghz

cooler: corsair h100 @ full speed push-pull

motherboard: Asus Rampage IV Extreme

gpu: 2x EVGA GTX660's & 1x EVGA GTX980

ssd: 2x samsung 256GB 840 pro raid 0

ssd: 1x samsung 1TB 840 evo

hdd: WD green 3TB

hdd: Seagate Barracuda 1TB (st1000dm003)

hdd: Seagate Barracuda 1TB (st31000520as)

psu: corsair ax1200i

ram: 8x 4GB corsair platinum @1866mhz

case: coolermaster cosmos II

age: Do the math (summer 2012)

monitors Main: 8x LG 22EA53 1080p 60hz

monitor Extra: 1xiiyama prolite G2773Hs 1080p 120hz 27"

os: windows 7 pro (64-bit)

keyboard: logitech g19

mouse: corsair m60

 


Lenovo T550

 


RaspBerry pi webserver:

Status: Offline.

 

Nas:

Status: Offline.

 


PC straight to the modem/router/switch/DHCP-Server/... with a 20cm (+-8inch) cat6a patch cable because same price as cat5.

ISP: Telenet (belgium)

Speed: 60Down-4Up (+- 45€/month)

ping to there servers: +-8ms

ping to other Belgians: +-12ms

 

 



- wheels for cosmos II


 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

interesting, it also saves it self as a screensaver.

 

Snip

 

Huh. What's the image look like?

The year is 20XX. Everyone plays Fox at TAS levels of perfection. Because of this, the winner of a match depends solely on port priority. The RPS metagame has evolved to ridiculous levels due to it being the only remaining factor to decide matches.

Only Abate, Axe, and Wobbles can save us.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Huh. What's the image look like?

Is that rhetorical or serious? :P

Someone told Luke and Linus at CES 2017 to "Unban the legend known as Jerakl" and that's about all I've got going for me. (It didn't work)

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

i can give you teamviewer access into that vm so you can take a look

theres also a fake steam account on there

Stream it with OBS and do it on Twitch.

Main rig on profile

VAULT - File Server

Spoiler

Intel Core i5 11400 w/ Shadow Rock LP, 2x16GB SP GAMING 3200MHz CL16, ASUS PRIME Z590-A, 2x LSI 9211-8i, Fractal Define 7, 256GB Team MP33, 3x 6TB WD Red Pro (general storage), 3x 1TB Seagate Barracuda (dumping ground), 3x 8TB WD White-Label (Plex) (all 3 arrays in their respective Windows Parity storage spaces), Corsair RM750x, Windows 11 Education

Sleeper HP Pavilion A6137C

Spoiler

Intel Core i7 6700K @ 4.4GHz, 4x8GB G.SKILL Ares 1800MHz CL10, ASUS Z170M-E D3, 128GB Team MP33, 1TB Seagate Barracuda, 320GB Samsung Spinpoint (for video capture), MSI GTX 970 100ME, EVGA 650G1, Windows 10 Pro

Mac Mini (Late 2020)

Spoiler

Apple M1, 8GB RAM, 256GB, macOS Sonoma

Consoles: Softmodded 1.4 Xbox w/ 500GB HDD, Xbox 360 Elite 120GB Falcon, XB1X w/2TB MX500, Xbox Series X, PS1 1001, PS2 Slim 70000 w/ FreeMcBoot, PS4 Pro 7015B 1TB (retired), PS5 Digital, Nintendo Switch OLED, Nintendo Wii RVL-001 (black)

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

interesting, it also saves it self as a screensaver.

-img-

Yep, another part of their Social Engineering - Users think a screensaver can't do any harm, but it's an executable file like .exe is.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Is that rhetorical or serious? :P

 

Sorry. I can't see it too well o. The post and I'm on an iPad so I can't download it myself.....

 

I've found the account the items are going to. Steam ID 76561198125064394 comes to http://steamcommunity.com/id/oneonlyonekey

I'm not saying go give him hell but what I'm saying is you know what to do. Report etc.

 

Just send him a message that says "we found you!"

The year is 20XX. Everyone plays Fox at TAS levels of perfection. Because of this, the winner of a match depends solely on port priority. The RPS metagame has evolved to ridiculous levels due to it being the only remaining factor to decide matches.

Only Abate, Axe, and Wobbles can save us.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

i can give you teamviewer access into that vm so you can take a look

theres also a fake steam account on there

I've completely disassembled the code so there's no need anymore.

Let me do a bit of writing and screenshotting the code and you'll see.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Sorry. I can't see it too well o. The post and I'm on an iPad so I can't download it myself.....

 

The image is of items in a inventory on steam.

I've completely disassembled the code so there's no need anymore.

Let me do a bit of writing and screenshotting the code and you'll see.

 

BTW, I want to get into processor design and such. By any chance would you know how I could work on that?

Someone told Luke and Linus at CES 2017 to "Unban the legend known as Jerakl" and that's about all I've got going for me. (It didn't work)

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Damn JvHummel beat me to it.

PEWDIEPIE DONT CROSS THAT BRIDGE

 

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

The dude's profile says he's from Paraguay, which is in South Africa. Not a great sign.

 

Also nice job @

Project Cobalt: 

CPU: AMD FX 8370 Motherboard:

Asus M5A97 R2.0

RAM: G.Skill Ares 16GB (2x8GB) DDR3 2133 GPU:

Gigabyte GTX 970 G1 Gaming Case: NZXT H440 (Blue)

Storage: Samsung 840 EVO 256GB +  2x 1TB WD Cavier Blue

PSU: Corsair 750G2 

CPU Cooler: Swiftech H220X

Keyboard: Model M + a lot of others 

Mouse: Logitech G502
 

Vintage Gaming PC: AMD Athlon T-Bird 800Mhz, Gainward nVidia Ti200 128MB, 512MB Crucial RAM DDR, Compaq ASPEN 2 OEM Board, Soundblaster Live! 5.1, Windows 98SE

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

My friend sent this to everyone on his steam list and we all assumed his account was compromised

Life.exe is missing

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Off Topic

×