Fake Battlefield 6 Downloads Deliver Information Stealers and a C2 Agent
Summary
Bitdefender analyzed three fake Battlefield 6 downloads: a trainer that steals browser, wallet, and Discord data; an evasive sample with possible credential-theft aims; and an ISO that installs a persistent C2 agent.
Key points
- Fake game cracks and trainers found on torrent sites and other domains had no Battlefield 6 functionality.
- A fake trainer steals browser cookies and wallet data, plus Discord session tokens and credentials, and sends the data over plaintext HTTP.
- An InsaneRamZes-themed sample checks regional settings, hashes Windows API calls, and uses a timing check to detect sandboxes; analysis suggested possible interest in developer credentials.
- A RUNE-themed ISO writes a DLL-like payload and runs it through regsvr32; the code is designed to beacon to a domain and support remote control or data theft.
- Bitdefender could not determine how many users downloaded the files; it observed hundreds of torrent seeders and leechers.
- Bitdefender recommends downloading games from official platforms and avoiding unknown trainers, torrents, and executables.
Article Details
- Attack Vectors
- Fake Battlefield 6 cracked-game installers distributed through torrent websites and underground forums deliver malware.
- A fake Battlefield 6 trainer installer found through web searches steals browser data, crypto-wallet information, Discord session tokens, and credentials.
- A fake Battlefield 6 ISO image contains a compressed payload that writes 2GreenYellow.dat and executes it with regsvr32.exe.
- The InsaneRamZes-named torrent sample checks regional settings and uses API hashing and a timing check to evade analysis.
- Defensive Notes
- Download games only from official platforms.
- Avoid torrents, third-party trainer utilities, and unknown executables.
- Use real-time behavioral protection to block malicious payloads before execution.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | ei-in-f101[.]1e100[.]net | Host contacted repeatedly by the C2 agent; the article says it may be used as a relay or to disguise C2 communications. |
| IPV4 | 198[.]251[.]84[.]9 | Destination receiving stolen information over plaintext HTTP from the fake trainer stealer. |
MITRE ATT&CK
T1027.007 · Dynamic API ResolutionThe sample hides Windows API calls behind hashed strings and matches hashes to identify target APIs.T1041 · Exfiltration Over C2 ChannelThe fake trainer exfiltrates stolen information to 198[.]251[.]84[.]9 over plaintext HTTP.T1218.010 · Regsvr32The RUNE-named sample silently executes 2GreenYellow.dat with regsvr32.exe using the /s /i options.T1497.003 · Time Based ChecksThe InsaneRamZes-named sample uses a GetTickCount() timing test to check whether it is running in a sandbox.T1555.003 · Credentials from Web BrowsersThe fake trainer retrieves browser profile data, including crypto-wallet and cookie-session data from browsers.
Products
Battlefield 6Fake Battlefield 6 Pirated Versions and Game Trainers Used to Deploy Stealers and C2 AgentsBraveCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.DiscordSession tokens and credentials from Discord.EdgeCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.Google ChromeCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.Mozilla FirefoxCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.OperaCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.VivaldiCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.WaveBrowserCrypto Wallets and Cookie Sessions from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and WaveBrowser.