File verdict·Decided by the MT AI Engine
Our call

Safe

Widely distributed, properly signed Steam installer with zero malicious engine detections and clean sandbox outcome.

Verified · Valve Corp.
Trust score92High trust
MT AI confidence · 90%
SteamSetup.exe
2.3 MB
7d3654531c32d941b845a0a12bcb
Antivirus engines
0 of 73 flagged
Code signing
Signed by Valve Corp.
Age
First seen 2y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

90%Confidence
Very high
Reasoning

The complete absence of malicious detections from every engine tier, including 17 tier-1 engines, combined with verified Valve Corp. signing and massive historical prevalence, strongly indicates a legitimate Steam installer. Sandbox execution returned no malicious verdict and no malicious children or contacted hosts were identified. While synthesis heuristics flagged persistence and direct-IP contact, these behaviours align with NSIS installer mechanics and certificate CRL checks rather than malware activity. The four YARA rules target installer structure, not malicious payloads.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.malicious=0 with tier1Malicious=0 and tier1ReportedClean=17

  2. signing.verified=true, signer='Valve Corp.'

  3. prevalence.classification='common_old' (204448 submissions)

  4. hasMaliciousSandboxVerdict=false, droppedChildren.hasMaliciousChild=false

  5. yaraify rules are NSIS installer detectors only

Points in its favour
  • Zero malicious detections across 73 engines
  • Verified Valve Corp. digital signature
  • Hundreds of thousands of prior clean submissions
  • Clean sandbox verdict with no malicious children
What to do

Treat as safe; download only from the official Steam website and verify the digital signature before execution.

Threat family attribution

NSIS Nullsoft Installer corroborated by 1 source

  • 4 YARA rules
    Detect_NSIS_Nullsoft_Installer, PE_Digital_Certificate, NSIS_April_2024
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
39

Adversary techniques mapped to the MITRE ATT&CK framework.

T1010T1012T1018T1027T1027.002T1027.009T1036T1045T1050T1055T1057T1059T1070T1071T1082T1083T1112T1115T1125T1129T1134T1140T1198T1218.011+15 more
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\Desktop\program.exe"
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
$(unnamed)
"C:\Program Files (x86)\Steam\steam.exe"
$(unnamed)
C:\Windows\System32\svchost.exe -k NetworkService -p
$(unnamed)
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
+7 more processes captured.
Network activity
28
IP addresses20
  • 199.232.215.52
  • 104.18.20.213
  • 199.232.215.82
  • 104.18.21.213
  • 192.168.0.51
  • 20.99.186.246
  • 23.216.81.152
  • 23.216.147.76
  • 192.168.0.5
  • 23.216.147.64
+10 more
URLs8
  • http://r13.c.lencr.org/113.crl
  • http://r12.c.lencr.org/10.crl
  • http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
  • http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
  • http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt
+2 more
Persistence
1
Indicators1
  • Steam Client Service
Filesystem & mutexes
40
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\nswCE6C.tmp
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\System.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\modern-header.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\modern-wizard.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\nsDialogs.dll
+10 more
Files deleted15
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\modern-header.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\modern-wizard.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\nsDialogs.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\nsExec.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsrCE8D.tmp\nsProcess.dll
+10 more
Mutexes created10
  • SteamSingleInstance
  • Local\InternetShortcutMutex
  • cversions.3.m
  • Global\OneSettingQueryMutex+compat+encapsulation
  • NULL
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • fbc09c1b9a55d04b57be91b05bNever scanned
    never seen before
  • f4370281335c1b45718deb4107Never scanned
    never seen before
  • d8a20dd2c9bf3abcd163b3a314Never scanned
    never seen before
  • ba82765c4e15026a8ffb2db06eNever scanned
    never seen before
  • 7c192b81ab67e34c84634ab043Never scanned
    never seen before
  • ac3706ebbb78cfba74e50aba8fNever scanned
    never seen before
  • e279c71136a3969cdec8eb1132Never scanned
    never seen before
  • 3d18d59ed87bd6ebcf7655f3daNever scanned
    never seen before
  • f4343274a97389f3e55a788503Never scanned
    never seen before
  • 4246c0b859204919663efaeb9bNever scanned
    never seen before
External threat intelligence

2 corroborating signals from researcher-curated sources

YARAify HIT·4 community rules matchedView on YARAify
  • Detect_NSIS_Nullsoft_Installerby Obscurity Labs LLC
    Detects NSIS installers by .ndata section + NSIS header string
  • PE_Digital_Certificateby albertzsigovits
  • NSIS_April_2024by NDA0N
    Detects NSIS installers
  • PE_Potentially_Signed_Digital_Certificateby albertzsigovits
CIRCL hashlookup HIT·known-good reference DB·trust 50/100View on CIRCL
modern.db· 222386^^SteamSetup.exe
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

4 YARAify4 synthesis
MITRE ATT&CK profile
Persistence× 1Defense evasion× 1Cred access× 1C2× 1
YARAify (community)
Researcher-authored rules via abuse.ch
  • Detect_NSIS_Nullsoft_Installer
  • PE_Digital_Certificate
  • NSIS_April_2024
  • PE_Potentially_Signed_Digital_Certificate
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • PersistenceScheduledTaskmedium

    Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).

    Evidence
    Steam Client Service
  • ProcessInjectionhigh

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\Explorer.EXE
  • CredentialDumpermedium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
  • DirectIpC2medium

    Sample contacted 14 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    199.232.215.52 · 104.18.20.213 · 199.232.215.82
Antivirus engine breakdown

0 detections across 73 engines

0 malicious0 suspicious73 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust16 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 73 engines report this file as clean.
Hash 7d3654531c32… cross-referenced against 73 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy5 sections
.text
6.45
.rdata
5.16
.data
3.98
.ndata
0.00
.rsrc
6.21
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
3,701
Hundreds of people have uploaded this — common.
Total submissions
204,448
Includes repeat uploads by the same source.
First seen by VT
2y ago
May 20, 2024
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/20/2024, 7:00:00 PM
First seen (MalwareBazaar)
Last analysis (VT)
7/7/2026, 1:41:21 PM
Scanned here
7/7/2026, 2:29:28 PM
File name
SteamSetup.exe
Size
2.27 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5
1b54b70beef8eb240db31718e8f7eb5d
SHA-1
da5995070737ec655824c92622333c489eb6bce4
PE imphash
4ea4df5d94204fc550be1874e1b77ea7
First seen (VT)
5/20/2024, 7:00:00 PM
Last analysis (VT)
7/7/2026, 1:41:21 PM
First scan (MalwareTips)
7/7/2026, 2:29:28 PM
Last scan (MalwareTips)
7/7/2026, 2:29:28 PM
Code signer
Valve Corp.verified
Community reputation
+105trusted
Behavior tags
peexelong-sleepsknown-distributorpersistencedetect-debug-environmentsignedlegitoverlay
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.