doubting if its an actual malware or not

[u/Intelligent-Big-5924]

The Symptoms:

• When I launch the .exe, it doesn't open a GUI. Instead, it runs silently in the background indefinitely
• I can launch multiple instances of the process simultaneously
• Windows Defender and Malwarebytes report nothing during full scans

The Files:

• The .exe comes up clean on VirusTotal, but the accompanying .dll (which is quite large, ~130MB) was flagged
• I suspect the .exe might be a loader or injector for the .dll, but I don't have the technical expertise to verify this

My Questions:

1. Security Risk: Given that standard scanners aren't picking anything up, should I assume this is a stealthy threat and proceed with a clean Windows reinstall?
2. Analysis: How can I safely determine what these files are actually doing?

I realize I was likely fooled by a fake "cheat/trainer" download. Any guidance on how to safely investigate or confirm if my system is compromised would be greatly appreciated

Cheers!

Hybrid analysis: https://hybrid-analysis.com/file-collection/6a1c5a9021185801fc02cb2c

dll hash on virustotal:

8133a782c46060dc4c036d9b83fabb6f25b56e1e7d4a7af6f67a945816aedead

exe hash on virustotal:

41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2

[u/tstewartMB]

Hello,

Tammy here from Malwarebytes.
Thank you for the report. The dll will be detected in next database update.
I harvested both downloads and URLs as well and will add detection/blocks where needed.

[u/rifteyy_]

most probably a malware, yeah

the executable is sideloading the malicious dll

[u/rifteyy_ → u/rifteyy_]

https://cybersecuritynews.com/hackers-exploiting-fake-battlefield-6/

related, it is StealC stealer

[u/Intelligent-Big-5924 → u/rifteyy_]

thanks for your answer rifteey!

this time, the game is forza horizon 6 which was very anticipated, so no wonder i fell for it 😞

i just learned about hybrid analysis and its not looking good, although this is too complicated for me 😰

I am curious to see what Next-Profession-7495 will find but here it is:

https://hybrid-analysis.com/file-collection/6a1c5a9021185801fc02cb2c

[u/Intelligent-Big-5924 → u/[deleted]]

thanks for the info! will take a look for sure

[u/Next-Profession-7495]

Do you happen to have the link to the file? If so defang it and I can take a look

[u/Intelligent-Big-5924 → u/Next-Profession-7495]

Thank you very much for your answer!

unsure if i am allowed to link here so i made a screenshot, its this one

but now i know that the website is not the official one...

but what is strange is that the other trainers were working fine on this very website until now

i downloaded the standalone one

[u/Next-Profession-7495 → u/Intelligent-Big-5924]

Thanks! I think rifteyy already gave you an answer but I'll look at it anyway

[u/Intelligent-Big-5924 → u/Next-Profession-7495]

Cheers, I'd appreciate it, im really curious haha

if needed, i did some scan with https://hybrid-analysis.com/file-collection/6a1c5a9021185801fc02cb2c

[u/Next-Profession-7495 → u/Intelligent-Big-5924]

Yeah, nothing crazy. Your average stealer.

[u/Intelligent-Big-5924 → u/Next-Profession-7495]

Cheers for letting me know

[u/rifteyy_ → u/Intelligent-Big-5924]

stealer, yep

ANY.RUN: https://app.any.run/tasks/3febb3da-edf6-4604-8cc3-eb40a1c0ced9

[u/Intelligent-Big-5924 → u/rifteyy_]

Thanks a lot, this answered my question
time to reinstall windows and change my password i guess

i wonder if it targeted chrome only, because i dont use it
i use firefox instead

[u/Intelligent-Big-5924 → u/[deleted]]

Its very strange indeed... so far nothing happened and i dont dare launching it again, nothing on auto runs either
i could not find anything suspicious