SteamStealer - A look into the source code

I've been wanting to take a little bit of a look at the recent SteamStealer malware going around throughout November and December. There's a few different types, mainly being .src executables that once executed connect to a designated domain and drop more stuff. The other more recent type uses a custom crypter with a library containing a RunPE function to inevitably load SteamStealer into the process. In any case, I won't be doing any "on the surface" analysis/removal tips, as it's been nicely done by blogs such as this. I'll instead be taking a look at the source code for a few of these .src files, and talking a bit about them as well.

So first off, the big thing regarding a lot of these recent .src files is they are obfuscated with Confuser, or its successor known as ConfuserEx. Confuser is a pretty popular free obfuscator mainly because it's one that isn't completely easy to reverse. It's still reversible, just not as easy as many other free obfuscators out there. You can do it with WinDbg which is absolutely gruesome and not really recommended for .NET deobfuscation, as anything really past methods is difficult and time consuming. Alternatively, you can use the wonderful internet world we have to get any slew of tools to decrypt methods, delegate killer, dump, and string decrypt.

Let's first take a look at what the thumbnails for the samples look like:

As we can see, the thumbnails appear as a Steam inventory with various items.

Back to obfuscation, if we try to take one of our .src samples obfuscated with Confuser into IDA, here's what we get:

After deobfuscation however, we can successfully take a somewhat broken look at the source code. Near the top of the code you can generally find the following (and hilarious) format:

 newobj  instance void SteamWorker::.ctor()  
   stloc.0  
   ldloc.0  
   ldstr  "7656119816xxxxxxx" // Steam ID  
   ldstr  "203496355"  
   ldstr  "N71Ll_bP"  

All of the Steam ID's extracted from various source code samples are all 8 or 9 (mostly 9) digit ID's, implying they're new and not old accounts by any means. With this said, these accounts were of course created for the sole purpose of spamming trades with this malware, and most likely selling valuable items for real money. I wouldn't be surprised if they were purchased or stolen ID's.

   callvirt instance void SteamWorker::getSessionID()  
   ldloc.0  
   ldstr  "csgolounge"  
   ldstr  "how much is this karambit knife? hxxp://screen4say.com/image.png"  
   callvirt instance void SteamWorker::SpamGroup(string, string)  
   ldloc.0  
   ldstr  "dota2lounge"  
   ldstr  "how much is this unusual courier? hxxp://screen4say.com/image.png"  
   callvirt instance void SteamWorker::AddGroupAndMess(string, string)  
   ldloc.0  
   callvirt instance void SteamWorker::getFriends()  
   ldloc.0  
   ldstr  "He give me this knife hxxp://screen4say.com/image.png ty for you :)"  
   callvirt instance void SteamWorker::sendMessWall(string)  
   ldloc.0  
   callvirt instance void SteamWorker::DeleteAll()  

Above is an example of one of the many domains used in the malware (purged). You can see it would join the Steam group "csgolounge" and then message users "how much is this karambit knife?" with a link to the malware. This is how it mainly propagated, by joining various Steam trade groups and spamming anyone with public inventories. Mainly "csgolounge" and "dota2lounge" as those were the main games used for the malware.

Domains used from what I've seen are: prntsrc-online, screen4free, hostingscreen, screenshotyou, etc.

If we do a lookup on any one of those:

 Domain name: prntsrc-online.com  
 Domain idn name: prntsrc-online.com  
 Status: clientTransferProhibited  
 Registry Domain ID:  
 Registrar WHOIS Server: whois.reg.ru  
 Registrar URL: https://www.reg.com/  
 Registrar URL: https://www.reg.ru/  
 Registrar URL: https://www.reg.ua/  
 Updated Date: 2014-12-15  
 Creation Date: 2014-12-15T19:18:01Z  
 Registrar Registration Expiration Date: 2015-12-15  
 Registrar: Domain names registrar REG.RU LLC  
 Registrar IANA ID: 1606  
 Registrar Abuse Contact Email: Email Masking Image@reg.ru  
 Registrar Abuse Contact Phone: +7.4955801111  
 Registry Registrant ID:  
 Registrant Name: Ivan Ivanov  
 Registrant Organization: Yandex LTD  
 Registrant Street: ul.Koshkina 15 kv 4  
 Registrant City: Moscow  
 Registrant State/Province: MOSCOW STATE  
 Registrant Postal Code: 132170  
 Registrant Country: RU  
 Registrant Phone: +79871975615  
 Registrant Phone Ext:  
 Registrant Fax:  
 Registrant Fax Ext:  
 Registrant Email: spamspam228@mail.ru
 Registry Admin ID:  
 Admin Name: Ivan Ivanov  
 Admin Organization: Yandex LTD  
 Admin Street: ul.Koshkina 15 kv 4  
 Admin City: Moscow  
 Admin State/Province: MOSCOW STATE  
 Admin Postal Code: 132170  
 Admin Country: RU  
 Admin Phone: +79871975615  
 Admin Phone Ext:  
 Admin Fax:  
 Admin Fax Ext:  
 Admin Email: spamspam228@mail.ru  
 Registry Tech ID:  
 Tech Name: Ivan Ivanov  
 Tech Organization: Yandex LTD  
 Tech Street: ul.Koshkina 15 kv 4  
 Tech City: Moscow  
 Tech State/Province: MOSCOW STATE  
 Tech Postal Code: 132170  
 Tech Country: RU  
 Tech Phone: +79871975615  
 Tech Phone Ext:  
 Tech Fax:  
 Tech Fax Ext:  
 Tech Email: spamspam228@mail.ru  
 Name Server: ns1.hostinger.ru  
 Name Server: ns2.hostinger.ru  
 Name Server: ns3.hostinger.ru  
 Name Server: ns4.hostinger.ru  
 DNSSEC: Unsigned  

Regarding this search, we can see it's a Russian based domain that was created and is administered by spamspam228(at)mail.ru. There's no doubt spamspam228 is a legitimate email, right? My favorite part isn't the email, but that the registrant's name is Ivan Ivanov from the organization Yandex LTD. This is absolutely hilarious considering Yandex is a Russian search engine (and ISP I believe?). I don't think Mr. Ivan Ivanov from Yandex is behind this.

If we now go ahead and look up this email, we can see:

 The email [email protected] is related to these domains :  
 1. printsrceen.com  
 2. prntsrc-online.com  

There's another interesting one:

 Domain Name: PICTURES-SCREEN.NET  
 Registry Domain ID:  
 Registrar WHOIS Server: whois.publicdomainregistry.com  
 Registrar URL: www.publicdomainregistry.com  
 Updated Date: 2014-12-23T16:15:07Z  
 Creation Date: 2014-12-23T16:15:05Z  
 Registrar Registration Expiration Date: 2015-12-23T16:15:05Z  
 Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com  
 Registrar IANA ID: 303  
 Registrar Abuse Contact Email: 
 Registrar Abuse Contact Phone: +1-2013775952  
 Domain Status: clientTransferProhibited  
 Registry Registrant ID:  
 Registrant Name: Xuila Pitrov Vasielvis  
 Registrant Organization: ScreenPictures  
 Registrant Street: Puschcicha,4,15   
 Registrant City: Moscow  
 Registrant State/Province: Moscow  
 Registrant Postal Code: 148821  
 Registrant Country: RU  
 Registrant Phone: +7.9652422078  
 Registrant Phone Ext:  
 Registrant Fax:  
 Registrant Fax Ext:  
 Registrant Email: jesus7298@mail.ru  
 Registry Admin ID:  
 Admin Name: Xuila Pitrov Vasielvis  
 Admin Organization: ScreenPictures  
 Admin Street: Puschcicha,4,15   
 Admin City: Moscow  
 Admin State/Province: Moscow  
 Admin Postal Code: 148821  
 Admin Country: RU  
 Admin Phone: +7.9652422078  
 Admin Phone Ext:  
 Admin Fax:  
 Admin Fax Ext:  
 Admin Email: jesus7298@mail.ru  
 Registry Tech ID:  
 Tech Name: Xuila Pitrov Vasielvis  
 Tech Organization: ScreenPictures  
 Tech Street: Puschcicha,4,15   
 Tech City: Moscow  
 Tech State/Province: Moscow  
 Tech Postal Code: 148821  
 Tech Country: RU  
 Tech Phone: +7.9652422078  
 Tech Phone Ext:  
 Tech Fax:  
 Tech Fax Ext:  
 Tech Email: jesus7298@mail.ru  
 Name Server: ns1.webhost1.ru  
 Name Server: ns2.webhost1.ru  
 DNSSEC:Unsigned  

Administered by a Xuila Pitrov Vasielvis, from Russia once again, from the organization "ScreenPictures". It's the domain name backwards, hilarious. It's registered/administered by/to the email jesus7298(at)mail.ru. Once again, an interesting choice for an email.

If we now go ahead and look up this email, we can see:

 The email jesus7298@mail.ru is related to these domains :  
 1. pictures-screen.net  
 2. picturesscreen.net  
 3. screenshotcapture.net  

See the pattern? Lots of malicious domains hosted and administered by Russians.

So right away after deobfuscation you can find the Steam ID of the account the items are ultimately being sent to for collection, and information regarding the domain housing the malware. Of course after we find a Steam ID, we can look that up and find the profile on Steam Community. I won't be posting the Steam ID's publicly even though these accounts were used for malicious purposes, because I'm just here to analyze and that's it. You can probably dig up the profiles if you care enough to report them.

Right, so we can see that this account is level 1 (new), the only game it has played is Dota 2, and it has joined the Dota 2 group so it can spam the malware. We can see this person was nice enough to leave their Skype, name (possibly fake in some cases), etc. I have blanked it out as I noted I will. Let's take a look at another account:

This account is a bit more active, with 5.9 hours played of Dota 2 in the last two weeks. It's also level 2 as opposed to the previous account which was only level 1. This account is also in two of the usual spam groups, rather than one. With all of the above said, the above account was likely actively spamming successfully more than the first. Either that, or it was just used for spamming with the malware in general rather than prepared to be used for spamming.

You can see the "view more info" button, which hilariously the user left most if not all of their online credentials and places to find them. One of the links was to a Russian hack forum in which they hosted a thread offering various "services".

We can see some of the items the malware looked to steal:

   ldstr  "440,570,730,753"  
   ldstr  "753:gift;570:rare,legendary,Dc,mythical,arcana,normal,unusual,ancient,tool,key;440:unusual,hat,tool,key;730:tool,knife,pistol,smg,shotgun,rifle,sniper rifle,machinegun,sticker,key"  
   callvirt instance void SteamWorker::addItemsToSteal(string, [opt] string)  

The first few are Dota 2 tiers for the rarity quality for an item, and then we branch off to keys, unusual hats, hats in general, etc, and eventually ending up with Counter Strike items. Considering for example that unusual hats depending on the type, effect, etc can go upwards of several hundred dollars, this is a pretty annoying malware for people that aren't aware of it.

Overall however it's not a very impressive piece of malware by any means, just looks like script stuff. However I don't think it was meant to/supposed to be. It has obviously satisfied its original and intended goal, which was to steal items. A lot of people have had their items stolen, simply because a lot of people aren't aware as I noted above. Although I said I wouldn't go into removal, to avoid this malware other than just understanding how it works, just make your trades private.