Steam malware inside images

General system Gaming, sound and video
1

https://www.gdatasoftware.com/blog/steamhide-malware-in-profile-images

Pretty fun :laughing:
Obviously targeting Windows, but still…

1 Like
2

So:

  1. It’s not a “steam maleware”, but maleware using Steam as a CDN
  2. The maleware is hidden in steam profile pictures
  3. It’s not the actual attack vector, but just additional payload loaded after the initial attack was successful

?

So my question is: What is the initial maleware?

3

Not exactly, i haven’t found a better article on english language, but as far as i understood from other sources:

  1. It is malicious payload which can initially be used to spread fast like a worm using Steam (client) and then hijack Windows PC after self-executing:

    • Turns off M$ security features ( :rofl:)
    • Checks if it can get admin rights
    • self-copy to LOCALAPPDATA and makes itself persistence by also creating some registry keys

  2. Looks like not only profile, but wherever else like images in articles etc

  3. Pretty sure it is an actual attack vector, since it’s pretty big in scale (as far as it’s detected now), also there are plenty of functionality it has which were not activated so far, including:

    • Analyzing system for Microsoft teams (i’m sure you’ve heard recently about that one and hacks of US government agencies)
    • Send / recieve commands through twitter (now that’s a weird one :rofl: )

So yeah, it’s actually pretty dangerous.
Might be a bot net, might be a crypto-miner.
Might be whatever.

4

As far as I’ve read seems that it needs another malware (gotten by “usual” ways) to extract the information coded inside the image and so start the all shenanigans.

5

In other words, it makes your computer more secure, before nuking it. :rofl:

5 Likes
6

It’s a malware that likes challenges :wink:

1 Like