General
- Target ForzaHorizon4.exe
- Size 152.1MB
- Sample260701-ym4awsfx71
- SHA256 b838a79a65c6d1e12f46deaba3584e4c88ebccdfdc4214b4535ece4ba3c0abbe
- MD5 9cd142955c5c7e4c5bac486709c66891
- SHA1 b854427abf85715a052425262a4ecdf971167d2e
- SHA512 60566016ba31218a80009a1b363ed973c356a144f661f522f3ac465fd02e1ff191f783fb5b496941a519a78beb0133adc5c2cef5b0d2b39eda561b81a20e6293
- SSDEEP 1572864:CYyaVl+Bsr6asnmteN/erC4dnrGY+IBAvbV+rZWo4qjrImF:CYzlr6asnmYxerrGPIBAvJ+rZWSpF
- TLSH T16E78BE05BB81CDE1E41AD2759D6F82487662FC749F8187CB34EAB30D6E7E2C50E72825
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ForzaHorizon4.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ForzaHorizon4.exe
Resource
win11ltsc2024-20260630-en
23 signatures
150 seconds
Malware Config
Targets
-
- Target ForzaHorizon4.exe
- Size 152.1MB
- SHA256 b838a79a65c6d1e12f46deaba3584e4c88ebccdfdc4214b4535ece4ba3c0abbe
- MD5 9cd142955c5c7e4c5bac486709c66891
- SHA1 b854427abf85715a052425262a4ecdf971167d2e
- SHA512 60566016ba31218a80009a1b363ed973c356a144f661f522f3ac465fd02e1ff191f783fb5b496941a519a78beb0133adc5c2cef5b0d2b39eda561b81a20e6293
- SSDEEP 1572864:CYyaVl+Bsr6asnmteN/erC4dnrGY+IBAvbV+rZWo4qjrImF:CYzlr6asnmYxerrGPIBAvJ+rZWSpF
- TLSH T16E78BE05BB81CDE1E41AD2759D6F82487662FC749F8187CB34EAB30D6E7E2C50E72825
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects KillMBR
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.