Analysis date (UTC): 17 March 2026, 20:04Analysis environment: Windows 10 Pro, build 19044, x64

SteamTools.exe

MD5:94F35A901F17705E80B49D0A6A5DA747

SHA1:49CBB39E3DA84BCDA4A63010FC307DBD65A27BCB

SHA256:A73519D431A265A35F159A3596D1920956713011024226E4710638B5D993AB00

Analysis result

Threat level:Malicious activity

Tags:

pyinstallergithubpythonloader

Full analysis:Analysis SteamTools.exe (MD5: 94F35A901F17705E80B49D0A6A5DA747) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

SteamSetup.exe (PID: 8396)

SUSPICIOUS

The process drops C-runtime libraries

SteamTools.exe (PID: 3976)

Process drops python dynamic module

SteamTools.exe (PID: 3976)

Executable content was dropped or overwritten

SteamTools.exe (PID: 3976)
SteamSetup.exe (PID: 8396)
SteamService.exe (PID: 2992)

Application launched itself

SteamTools.exe (PID: 3976)

Loads Python modules

SteamTools.exe (PID: 6400)

Starts CMD.EXE for commands execution

cmd.exe (PID: 1868)
cmd.exe (PID: 7460)
cmd.exe (PID: 2564)
cmd.exe (PID: 8944)
cmd.exe (PID: 2148)
cmd.exe (PID: 468)
cmd.exe (PID: 7924)
cmd.exe (PID: 5768)
cmd.exe (PID: 4628)
cmd.exe (PID: 4196)

The process creates files with name similar to system file names

SteamSetup.exe (PID: 8396)

Malware-specific behavior (creating "System.dll" in Temp)

SteamSetup.exe (PID: 8396)

Uses TASKKILL.EXE to kill process

cmd.exe (PID: 8944)

Potential Corporate Privacy Violation

firefox.exe (PID: 5716)

INFO

Checks supported languages

SteamTools.exe (PID: 3976)
SteamTools.exe (PID: 6400)
SteamSetup.exe (PID: 8396)
SteamService.exe (PID: 2992)
Steam.exe (PID: 8816)
Steam.exe (PID: 8900)

Reads the computer name

SteamTools.exe (PID: 3976)
SteamTools.exe (PID: 6400)
SteamSetup.exe (PID: 8396)
SteamService.exe (PID: 2992)
Steam.exe (PID: 8816)
Steam.exe (PID: 8900)

The sample compiled with english language support

SteamTools.exe (PID: 3976)
firefox.exe (PID: 5716)
SteamSetup.exe (PID: 8396)
SteamService.exe (PID: 2992)

Create files in a temporary directory

SteamTools.exe (PID: 3976)
SteamSetup.exe (PID: 8396)
SteamTools.exe (PID: 6400)

PyInstaller has been detected (YARA)

SteamTools.exe (PID: 3976)
SteamTools.exe (PID: 6400)

The sample compiled with bulgarian language support

firefox.exe (PID: 5716)
SteamSetup.exe (PID: 8396)

Application launched itself

firefox.exe (PID: 9020)
firefox.exe (PID: 5716)

Launching a file from the Downloads directory

firefox.exe (PID: 5716)

Executable content was dropped or overwritten

firefox.exe (PID: 5716)

Creates files in the program directory

SteamSetup.exe (PID: 8396)
SteamService.exe (PID: 2992)
Steam.exe (PID: 8816)
SteamTools.exe (PID: 6400)
Steam.exe (PID: 8900)

Launching a file from a Registry key

SteamSetup.exe (PID: 8396)

Manual execution by a user

Steam.exe (PID: 8816)
Steam.exe (PID: 8900)
firefox.exe (PID: 9020)

Creates a software uninstall entry

SteamSetup.exe (PID: 8396)

Creates files or folders in the user directory

Steam.exe (PID: 8816)

Reads the machine GUID from the registry

Steam.exe (PID: 8816)
Steam.exe (PID: 8900)

Reads CPU info

Steam.exe (PID: 8816)
Steam.exe (PID: 8900)

There is functionality for taking screenshot (YARA)

Steam.exe (PID: 8816)
Steam.exe (PID: 8900)

Threats

PID	Process	Class	Message
2292	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
5716	firefox.exe	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP