Malicious BlockBlasters Steam Patch Delivered StealC and a Backdoor

Sep 22, 2025 · Original article ↗

Summary

A malicious August 30 BlockBlasters patch used scripts to steal Steam, browser, and crypto-wallet data and install StealC and a backdoor. The game was removed from Steam after more than 100 downloads were reported.

Key points

G DATA researchers found malicious files in BlockBlasters Build 19799326, released on Steam on August 30, 2025.
A batch script gathered IP and Steam account details, checked for antivirus processes, and sent collected data to a command-and-control server.
Additional scripts collected browser-extension and crypto-wallet information.
The malware added its execution folder to Microsoft Defender exclusions and launched payloads while starting the game to mask activity.
Payloads included a backdoor and StealC, which targeted Chrome, Brave, and Edge browser data.
Telemetry cited by the article indicated more than 100 downloads after the patch; the game was flagged as suspicious and removed from Steam.

Article Details

Attack Vectors: A patch for BlockBlasters (Build 19799326) distributed malicious batch files, VBS launchers, and password-protected archives to players.
The batch files collected Steam login information, browser extension data, and cryptocurrency wallet information, then sent collected data to command-and-control servers.
A batch file added the payload execution directory to the Microsoft Defender Antivirus exclusion list before unpacking and running the payloads.
The patch deployed a backdoor and StealC stealer; the backdoor ran the game executable to mask its activity.
Defensive Notes: BlockBlasters was removed from Steam shortly before the article was published, and SteamDB marked it as suspicious.
The article reports that Microsoft Defender Antivirus exclusions were added for the payload execution directory; review exclusions for unexpected entries.
The article reports that the patch archives were password-protected and that the scripts unpacked and executed their contents.

Indicators of compromise

Type	Indicator	Context
IPV4	`203[.]188[.]171[.]156`	IP address used by the campaign's C2 server.
IPV4	`45[.]83[.]28[.]99`	IP address used as the StealC payload's separate C2 channel.
SHA256	`17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a`	Hash listed for the malicious Client-built2.exe backdoor payload.
SHA256	`3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0`	Hash listed for malicious Test.bat.
SHA256	`58a97ab524b704172a8f68fda92daa802b706e397adede410b6475a4eb229c9b`	Hash of the password-protected v3.zip archive containing the payload executables.
SHA256	`59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e`	Hash listed for the malicious Block1.exe StealC payload.
SHA256	`aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3`	Hash listed for malicious Game2.bat.
SHA256	`b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b`	Hash listed for malicious Test.vbs.
SHA256	`c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3`	Hash listed for malicious Launch1.vbs.
SHA256	`cd817345f9e62fa8e9b66e47b645278e74f2a2cf59b8a81b88d1b2ec54b9933d`	Hash of the password-protected v1.zip archive installed with the malicious patch.
SHA256	`e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605`	Hash listed for malicious 1.bat.
URL	`hxxp[:]//203[.]188[.]171[.]156`	C2 URL used by the campaign's batch file and backdoor.
URL	`hxxp[:]//203[.]188[.]171[.]156:30815/upload`	C2 upload URL used by the batch file to send collected data.
URL	`hxxp[:]//45[.]83[.]28[.]99`	Separate C2 URL contacted by the StealC payload.