Steam Password Stealer is Stored on Google Drive

A Piece of Malware Aimed at Stealing Steam Account Credentials has been Making the Rounds Targeting Gamers through the Platform’s Chat Client for at Least a Week, Being Delivered from a Google Drive Account that is still Active.

It’s No Secret that, the Vigilance of Gamers on Steam is Constantly Tested by Luring them to Click on Malicious Links Posted in the Chat Box.

Some Users are Quick at Spotting the Attack and Stay Away from the URLs but, Others do Fall Victim to such Attempts and End Up with their Steam Account being Hijacked.

An Obvious Scam Can still Make Some Victims

The Scam is Quite Simple and it is Encountered on Steam More Often than One Would Like. A Gamer Known as 'Onyx', Showed in an Entry on Tumblr, the Standard Approach Used by the Attackers: a Simple Message Claiming to be from Someone Known to the Potential Victim Entices to Click on a Link (Often Times Shortened) under the Pretext to Find More Information about the Alleged Friend.

The URL in Fact Leads to Malware, which, Once Installed on the System, Steals the Log-In Data for the Steam Account, according to Bart Blaze, Malware Researcher at Panda Security, Who Analyzed the Sample and Provided a Technical Overview in a Blog Post on Sunday.

Blaze Explains that, the Malicious Link Proceeds to Download a Screensaver File (SCR), which is an Executable, from Google Drive; the SCR Purports to be a Picture and Even has an Image as the File Icon.

“Note that normally, the Google Drive Viewer application will be shown and this will allow you to download the .scr file. In this case, the string ‘&confirm=no_antivirus’ is added to the link, which means the file will pop-up immediately asking what to do: Run or Save. (and in some cases download automatically)”, he Writes.

Most Antivirus Solutions Protect Against it

The File has been Reported by the Researcher on Sunday but, it Appears that, No Action has been Taken Against it by Now because, it is still Available in the Google Cloud.

Luckily, Most Reputable Antivirus Solutions Detect it and Prevent its Download on the Computer. 37 Out of 55 Antivirus Engines on VirusTotal, Have No Trouble Quarantining it on the Spot.

In the Researcher’s Analysis, it is Noted that, the Malware Connects to a Server Hosted in the Czech Republic, Where the Stolen Info is Probably Uploaded.

Signs of the Steam Account Log-In Information Compromised via this Threat Consists in the Presence of a Process Named, “temp.exe”, “wrrrrrrrrrrrr.exe”, “vv.exe”, or One with a Random Name Running on the System; this Can be Checked with Task Manager.

In Case of Compromise, Users are Recommended to Immediately Change the Password for the Steam Account and Scan the System with a Reputable Antivirus.




Info Sources:

http://onyxhavok.tumblr.com/post/102332902501/so-this-person-added-me-on-steam-today

http://bartblaze.blogspot.ro/2014/11/malware-spreading-via-steam-chat.html