Starfield themed malware blasts off
With just weeks until the release of Bethesda’s next Han Solo role playing video game, threat actors are already queuing up trojan-ised versions of the game.
Unearthed
While on the hunt for malware, I came across this sample on Google’s VirusTotal, uploaded last week from a US IP address:
It’s notable for a bunch of reasons, including the fact it uses the legit Starfield logo:
The executable name was also Starfield.exe on upload:
The file itself is a remote access trojan, using these three domains as C2 servers:
blank-cbxur\.in
blank-jvqsr\.in
blank-o7mwe\.in
File hash:
ea6af173a3577fa192821f746d701365b759689eb3562ad546230f6da99a18ae
Another one posted yesterday as a full copy of the game (it’s also a Trojan, with little antivirus detection):
In English
This means the download was not, in fact, Starfield — it grants remote access to your PC, and allows stealing of information from your system.
Threat actors are using the offer of pirate downloads of Starfield to lure people into backdooring their system. There are no pirate downloads of Starfield at present.
The way to protect yourself from this kind of threat, I would strongly recommend not trying to pirate the game and instead buy it or get it on Gamepass.
What it does
Aside from establishing comms back to base, this trojan also alters Microsoft Defender AV settings to exclude itself from scanning, turns off real time detection, performs hardware reconisance and various things.
It also tries to steal Discord access tokens for the user.
It also displays a fake error message:
Other fake Starfield malware
If you enjoyed this post
Please boost my tweet where I’m asking Bethesda for a review copy of the game, in exchange for returning to Twitter to haunt the internet with my space cowboy adventures:
See you in space, travellers. Since I ran the official Serenity movie Browncoat site way back in 2004 for Universal, it seems apt to end with this:
Cheers,
~g
