Steam Gaming Platform Delivering Malware

Seem out for SteamHide, an rising loader malware that disguises alone within profile illustrations or photos on the gaming platform Steam, which researchers think is getting created for a wide-scale marketing campaign.

Steam’s most current details stated the platform has far more than 20 million customers actively playing game titles, which include well-liked titles like Counter-Strike: Worldwide Offensive, Dota 2 and Apex Legends.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“While hiding malware in an picture file’s metadata is not a new phenomenon, working with a gaming platform these as Steam is formerly unheard of,” G Information analyst Karsteen Hahn claimed about SteamHide in a new disclosure report, which builds on the authentic uncover by @miltinhoc on Twitter:

The malware downloader is hiding in the Steam profile image’s metadata, specially in the International Color Consortium (ICC) profile, a standardized established of knowledge to regulate color output for printing. Attackers hide their malware in benign photographs generally shared on line, which include memes like “blinking white guy” employed in the G Facts assessment example.

“The very low-high-quality image reveals a few frames of the ‘white person blinking’ meme together with the phrases January, a black monitor, and September,” Hahn included. “The graphic content by itself does not feel to make feeling.”

Victims of this profile image scam really don’t have to be on Steam or have any gaming system put in, G Data’s scientists identified. And updating the malware only requires uploading a new profile pic.

The profile picture knowledge only incorporates the downloader that fetches supplemental malware, the report stated.

Attackers Have Big Plans for SteamHide

“The large lifting in the condition of downloading, unpacking and executing the malicious payload is taken care of by an exterior part which just accesses the profile picture on 1 Steam profile,” Hahn reported. “This payload can be distributed by the regular usually means, from crafted email messages to compromised sites.”

As soon as executed, the malware terminates any security protections and checks for administration rights, the researchers observed, then copies by itself to “LOCALAPPDATA” folder and persists by generating a important in a registry that G Knowledge determined as “SoftwareMicrosoftWindowsCurrentVersionRunBroMal”

G Information said the builders of SteamHide have hidden applications within their malware that aren’t at present getting employed, but could be hazardous later on together with examining if Groups is set up on the contaminated device, and a approach stub named “ChangeHash” that indicates builders are operating on ever more complex iterations of the existing malware. There is also a device that permits the malware to send out and obtain instructions about Twitter.

“I am assured that we will see this malware emerge quickly in the wild just like it occurred with other in-progress people that we lined, e.g., StrRAT and SectopRAT,” according to scientists.

Steam’s mum or dad company Valve hasn’t responded to Threatpost’s request for comment on SteamHide.

This isn’t the initially time Steam has been hit with cybersecurity issues. For instance, final December, Steam experienced to correct critical bugs that authorized a distant attacker to crash a further player’s game, just take above the laptop and hijack all the computer systems related to a third-party server.

Download our exclusive Free of charge Threatpost Insider E-book, “2021: The Evolution of Ransomware,” to assist hone your cyber-protection techniques in opposition to this rising scourge. We go outside of the standing quo to uncover what is future for ransomware and the related rising threats. Get the total tale and Down load the Book now – on us!