Jump to content
Aerosol

SteamStealer - A look into the source code

Recommended Posts

I've been wanting to take a little bit of a look at the recent SteamStealer malware going around throughout November and December. There's a few different types, mainly being .src executables that once executed connect to a designated domain and drop more stuff. The other more recent type uses a custom crypter with a library containing a RunPE function to inevitably load SteamStealer into the process. In any case, I won't be doing any "on the surface" analysis/removal tips, as it's been nicely done by blogs such as this. I'll instead be taking a look at the source code for a few of these .src files, and talking a bit about them as well.

So first off, the big thing regarding a lot of these recent .src files is they are obfuscated with Confuser, or its successor known as ConfuserEx. Confuser is a pretty popular free obfuscator mainly because it's one that isn't completely easy to reverse. It's still reversible, just not as easy as many other free obfuscators out there. You can do it with WinDbg which is absolutely gruesome and not really recommended for .NET deobfuscation, as anything really past methods is difficult and time consuming. Alternatively, you can use the wonderful internet world we have to get any slew of tools to decrypt methods, delegate killer, dump, and string decrypt.

Let's first take a look at what the thumbnails for the samples look like:

three%2Bimages.png

As we can see, the thumbnails appear as a Steam inventory with various items.

Back to obfuscation, if we try to take one of our .src samples obfuscated with Confuser into IDA, here's what we get:

Illegal%2Bmethod%2Bheader%2Bbits%2B00.png

After deobfuscation however, we can successfully take a somewhat broken look at the source code. Near the top of the code you can generally find the following (and hilarious) format:

newobj  instance void SteamWorker::.ctor()  
stloc.0
ldloc.0
ldstr "7656119816xxxxxxx" // Steam ID
ldstr "203496355"
ldstr "N71Ll_bP"

All of the Steam ID's extracted from various source code samples are all 8 or 9 (mostly 9) digit ID's, implying they're new and not old accounts by any means. With this said, these accounts were of course created for the sole purpose of spamming trades with this malware, and most likely selling valuable items for real money. I wouldn't be surprised if they were purchased or stolen ID's.

callvirt instance void SteamWorker::getSessionID()  
ldloc.0
ldstr "csgolounge"
ldstr "how much is this karambit knife? hxxp://screen4say.com/image.png"
callvirt instance void SteamWorker::SpamGroup(string, string)
ldloc.0
ldstr "dota2lounge"
ldstr "how much is this unusual courier? hxxp://screen4say.com/image.png"
callvirt instance void SteamWorker::AddGroupAndMess(string, string)
ldloc.0
callvirt instance void SteamWorker::getFriends()
ldloc.0
ldstr "He give me this knife hxxp://screen4say.com/image.png ty for you :)"
callvirt instance void SteamWorker::sendMessWall(string)
ldloc.0
callvirt instance void SteamWorker::DeleteAll()

Above is an example of one of the many domains used in the malware (purged). You can see it would join the Steam group "csgolounge" and then message users "how much is this karambit knife?" with a link to the malware. This is how it mainly propagated, by joining various Steam trade groups and spamming anyone with public inventories. Mainly "csgolounge" and "dota2lounge" as those were the main games used for the malware.

Domains used from what I've seen are: prntsrc-online, screen4free, hostingscreen, screenshotyou, etc.

If we do a lookup on any one of those:

Domain name: prntsrc-online.com  
Domain idn name: prntsrc-online.com
Status: clientTransferProhibited
Registry Domain ID:
Registrar WHOIS Server: whois.reg.ru
Registrar URL: https://www.reg.com/
Registrar URL: https://www.reg.ru/
Registrar URL: https://www.reg.ua/
Updated Date: 2014-12-15
Creation Date: 2014-12-15T19:18:01Z
Registrar Registration Expiration Date: 2015-12-15
Registrar: Domain names registrar REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: Email Masking Image@reg.ru
Registrar Abuse Contact Phone: +7.4955801111
Registry Registrant ID:
Registrant Name: Ivan Ivanov
Registrant Organization: Yandex LTD
Registrant Street: ul.Koshkina 15 kv 4
Registrant City: Moscow
Registrant State/Province: MOSCOW STATE
Registrant Postal Code: 132170
Registrant Country: RU
Registrant Phone: +79871975615
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: spamspam228@mail.ru
Registry Admin ID:
Admin Name: Ivan Ivanov
Admin Organization: Yandex LTD
Admin Street: ul.Koshkina 15 kv 4
Admin City: Moscow
Admin State/Province: MOSCOW STATE
Admin Postal Code: 132170
Admin Country: RU
Admin Phone: +79871975615
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: spamspam228@mail.ru
Registry Tech ID:
Tech Name: Ivan Ivanov
Tech Organization: Yandex LTD
Tech Street: ul.Koshkina 15 kv 4
Tech City: Moscow
Tech State/Province: MOSCOW STATE
Tech Postal Code: 132170
Tech Country: RU
Tech Phone: +79871975615
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: spamspam228@mail.ru
Name Server: ns1.hostinger.ru
Name Server: ns2.hostinger.ru
Name Server: ns3.hostinger.ru
Name Server: ns4.hostinger.ru
DNSSEC: Unsigned

Regarding this search, we can see it's a Russian based domain that was created and is administered by spamspam228(at)mail.ru. There's no doubt spamspam228 is a legitimate email, right? My favorite part isn't the email, but that the registrant's name is Ivan Ivanov from the organization Yandex LTD. This is absolutely hilarious considering Yandex is a Russian search engine (and ISP I believe?). I don't think Mr. Ivan Ivanov from Yandex is behind this.

If we now go ahead and look up this email, we can see:

The email [email protected] is related to these domains :  
1. printsrceen.com
2. prntsrc-online.com

There's another interesting one:

Domain Name: PICTURES-SCREEN.NET  
Registry Domain ID:
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: www.publicdomainregistry.com
Updated Date: 2014-12-23T16:15:07Z
Creation Date: 2014-12-23T16:15:05Z
Registrar Registration Expiration Date: 2015-12-23T16:15:05Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +1-2013775952
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Xuila Pitrov Vasielvis
Registrant Organization: ScreenPictures
Registrant Street: Puschcicha,4,15
Registrant City: Moscow
Registrant State/Province: Moscow
Registrant Postal Code: 148821
Registrant Country: RU
Registrant Phone: +7.9652422078
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: jesus7298@mail.ru
Registry Admin ID:
Admin Name: Xuila Pitrov Vasielvis
Admin Organization: ScreenPictures
Admin Street: Puschcicha,4,15
Admin City: Moscow
Admin State/Province: Moscow
Admin Postal Code: 148821
Admin Country: RU
Admin Phone: +7.9652422078
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: jesus7298@mail.ru
Registry Tech ID:
Tech Name: Xuila Pitrov Vasielvis
Tech Organization: ScreenPictures
Tech Street: Puschcicha,4,15
Tech City: Moscow
Tech State/Province: Moscow
Tech Postal Code: 148821
Tech Country: RU
Tech Phone: +7.9652422078
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: jesus7298@mail.ru
Name Server: ns1.webhost1.ru
Name Server: ns2.webhost1.ru
DNSSEC:Unsigned

Administered by a Xuila Pitrov Vasielvis, from Russia once again, from the organization "ScreenPictures". It's the domain name backwards, hilarious. It's registered/administered by/to the email jesus7298(at)mail.ru. Once again, an interesting choice for an email.

If we now go ahead and look up this email, we can see:

The email jesus7298@mail.ru is related to these domains :  
1. pictures-screen.net
2. picturesscreen.net
3. screenshotcapture.net

See the pattern? Lots of malicious domains hosted and administered by Russians.

So right away after deobfuscation you can find the Steam ID of the account the items are ultimately being sent to for collection, and information regarding the domain housing the malware. Of course after we find a Steam ID, we can look that up and find the profile on Steam Community. I won't be posting the Steam ID's publicly even though these accounts were used for malicious purposes, because I'm just here to analyze and that's it. You can probably dig up the profiles if you care enough to report them.

Max.Trojan.png

Right, so we can see that this account is level 1 (new), the only game it has played is Dota 2, and it has joined the Dota 2 group so it can spam the malware. We can see this person was nice enough to leave their Skype, name (possibly fake in some cases), etc. I have blanked it out as I noted I will. Let's take a look at another account:

FaceControll%2B10%2Byears.png

This account is a bit more active, with 5.9 hours played of Dota 2 in the last two weeks. It's also level 2 as opposed to the previous account which was only level 1. This account is also in two of the usual spam groups, rather than one. With all of the above said, the above account was likely actively spamming successfully more than the first. Either that, or it was just used for spamming with the malware in general rather than prepared to be used for spamming.

You can see the "view more info" button, which hilariously the user left most if not all of their online credentials and places to find them. One of the links was to a Russian hack forum in which they hosted a thread offering various "services".

We can see some of the items the malware looked to steal:

ldstr  "440,570,730,753"  
ldstr "753:gift;570:rare,legendary,Dc,mythical,arcana,normal,unusual,ancient,tool,key;440:unusual,hat,tool,key;730:tool,knife,pistol,smg,shotgun,rifle,sniper rifle,machinegun,sticker,key"
callvirt instance void SteamWorker::addItemsToSteal(string, [opt] string)

The first few are Dota 2 tiers for the rarity quality for an item, and then we branch off to keys, unusual hats, hats in general, etc, and eventually ending up with Counter Strike items. Considering for example that unusual hats depending on the type, effect, etc can go upwards of several hundred dollars, this is a pretty annoying malware for people that aren't aware of it.

Overall however it's not a very impressive piece of malware by any means, just looks like script stuff. However I don't think it was meant to/supposed to be. It has obviously satisfied its original and intended goal, which was to steal items. A lot of people have had their items stolen, simply because a lot of people aren't aware as I noted above. Although I said I wouldn't go into removal, to avoid this malware other than just understanding how it works, just make your trades private.

Source

  • Downvote 1
Link to comment
Share on other sites

exact... puteti incerca coailii ca mine :D eu asa prind.. si prima data sparg emailul :D dupa ce schimb emailul fur tot ce are pe elsi ma intorc la panel sa vad daca am omis ceva important

De tine imi pare rau, observ ca ai potential, dar iti trebuie un avant...

Poti sa raspunzi la o intrebare, ce dracu a scris aerosol, despre ce plm se vorbeste in topicul care l-a deschis?

Ce pm de relevanta au raspunsurile tale, referitor la ce-a scris el?

ar fi sunat mai bine, un reply de genul "Ana are mere."

  • Upvote 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...