avalancherunner: 1a38a948 — .NET game-masquerade loader with encrypted CLR resource payload

Executive Summary

A .NET Framework 4.5 PE32 binary masquerading as a game (AvalancheRunner) but delivered with the filename Bank_Payment_Advice20396.exe. The outer binary is unobfuscated C# WinForms with Uzbek-language UI strings, yet it embeds a ~952 KB encrypted/zlib-compressed CLR resource blob and carries encrypt/decrypt routines (Shifrlash, Deshifrlash, ObfKalit). Capa flags reflective code loading (T1620) and file/directory discovery (T1083). No CAPE detonation was possible (no Windows guest), so all behaviour is inferred from static. Low-confidence family label avalancherunner — tentatively named after the decoy identity.

What It Is

Version-info masquerade

The VS_VERSIONINFO block claims ^[exiftool.json:36-45] ^[pefile.txt:234-243]:

• ProductName / FileDescription: AvalancheRunner
• CompanyName: Antigravity
• Comments: Ko'chki Chopari O'yini (Uzbek — "Mountain Village Shepherd Game")
• InternalName / OriginalFilename: hHRu.exe
• GUID: a8b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c

The filename Bank_Payment_Advice20396.exe directly contradicts the version-info identity — a classic social-engineering lure. See version-info-masquerade.

How It Works

Outer shell — decoy game UI

The binary is a standard C# WinForms application with three forms (OyinFormasi, NatijaFormasi, OyinSozlamalari) and a Program entry point. Class and method names are in Uzbek:

• OyinniBoshlash — Start Game
• OyinniTugatish — End Game
• ToshMexanikasi — Rock Mechanics (game physics)
• YulduzlarniYarat / YulduzlarniYangila — Create / Refresh Stars
• YuklabOlish — Download
• Shifrlash / Deshifrlash — Encrypt / Decrypt
• ObfKalit — Obfuscation Key

These names are unobfuscated and visible in plain IL metadata. ^[strings.txt:211-219, 214-215, 495]

Embedded payload — CLR resource blob

The CLR header declares a resource blob at RVA 0xB5E0 with size 0xE8728 (~952 KB). ^[dnfile:ResourcesRva] This blob sits inside the .text section (raw offset 0x200 + 0x95E0). Binwalk identifies a 640×688 PNG image and zlib-compressed data inside the blob. ^[binwalk.txt:7-8]

Standard .resources files are referenced:

• AvalancheRunner.NatijaFormasi.resources
• AvalancheRunner.OyinFormasi.resources
• AvalancheRunner.Properties.Resources.resources ^[strings.txt:443-445]

Encryption / obfuscation routines

Four methods handle string/data transformation:

• Shifrlash — Encrypt
• Deshifrlash — Decrypt
• ShifrlashSatr — Encrypt String
• DeshifrlashSatr — Decrypt String

A property ObfKalit (Obfuscation Key) is present. ^[strings.txt:214-215, 433-434, 495] Capa confirms Base64 encode/decode and PRNG use in .NET. ^[capa.txt:36-38]

Reflective loading indicator

Capa flags:

• invoke .NET assembly method (2 matches)
• load .NET assembly
• access .NET resource ^[capa.txt:40, 42-44]

These strongly suggest the binary decrypts a second-stage assembly from the CLR resource blob and loads it reflectively via Assembly.Load or similar — the dotnet-manifest-resource-decryption pattern, but using .NET runtime resources rather than PE .rsrc manifest entries. No P/Invoke imports are present; everything is managed code. ^[pefile.txt:255]

Suspicious method name

Survey_Cadastral_Transect appears as an async lambda method name inside OyinFormasi. ^[strings.txt:16-17, 24] In a game binary, a method referencing land-survey terminology is anomalous and may be a hidden trigger or the actual payload execution routine masked behind an innocuous-looking compiler-generated name.

Decompiled Behavior

Radare2 analysis (level 4) recovered 411 managed methods. ^[r2:analysis] The entry point is entry0 at 0x00402246. Notable method RVAs include:

• OyinFormasi.Survey_Cadastral_Transect @ 0x00402328
• OyinFormasi.YulduzlarniYarat @ 0x004023a4
• OyinFormasi.OyinniBoshlash @ 0x004025a4
• OyinFormasi.survivalTimer_Tick @ 0x0040278c
• OyinFormasi.rockSpawnTimer_Tick @ 0x004027fc
• OyinFormasi.OyinFormasi_KeyDown @ 0x00402840
• OyinFormasi.pnlOyinMaydoni_Paint @ 0x004028f4
• OyinFormasi.HudPaneliniChiz @ 0x00402948

Without a decompiler (dnSpy/ILSpy) or dynamic trace, the exact control flow inside Survey_Cadastral_Transect and the encrypt/decrypt routines cannot be mapped to specific IL instructions. The binary is not protected; ILSpy would yield full source-equivalent C# in minutes.

C2 Infrastructure

No network indicators recovered in static analysis. No hardcoded URLs, IPs, domains, or API endpoints. The YuklabOlish ("Download") method may resolve a remote URL at runtime from the encrypted resource blob, but this is speculative. Marked as C2 obfuscated / runtime-resolved.

Interesting Tidbits

1. Uzbek targeting clue: The entire UI is Uzbek (Oyin = game, Tosh = rock, Yulduz = star, Natija = result). Combined with the cadastral-survey method name, this suggests either a local-language builder or targeting of Uzbek-speaking victims.
2. Sequential GUID: The VS_VERSIONINFO GUID a8b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c is highly patterned, likely a hardcoded template value rather than a genuine randomly-generated GUID. ^[strings.txt:558]
3. Capa false positive on anti-analysis: The reference analysis tools strings hit in capa is triggered by standard .NET compiler-generated attributes (DebuggerBrowsableState, DebuggerNonUserCodeAttribute, etc.). These are not intentional anti-debug; they are emitted by Roslyn / VS for every debug build. ^[capa.txt:35] ^[strings.txt:155-181]
4. No P/Invoke, no native imports: The entire outer binary is managed C#. Any process injection, API hooking, or native evasion would have to come from the reflective second stage. ^[pefile.txt:255]
5. Resource size vs code size: The CLR resource blob (~952 KB) dwarfs the actual IL code (~990 KB total file, but much of .text is the resource blob). The "game" is mostly payload container. ^[dnfile:ResourcesSize] ^[binwalk.txt]

How To Mess With It (Homelab Replication)

Goal: Build a comparable .NET resource-based reflective loader and verify the capa fingerprint.

1. Toolchain: Visual Studio 2022 Community, .NET Framework 4.5 target, C# WinForms.
2. Steps:
   • Create a WinForms app with a decoy UI (buttons, timers, a game canvas).
   • Add a .resources file with a large encrypted/zlib-compressed payload (any PE or DLL).
   • Implement EncryptString / DecryptString routines using Base64 + a simple XOR or AES with a hardcoded key.
   • On a button click or timer tick, call Assembly.GetManifestResourceStream, decrypt the payload to a byte[], then Assembly.Load(byte[]) and invoke the entry method via reflection.
3. Compiler flags: Debug build (to match the Debugger* attribute bloat).
4. Verification:
   • Run capa <reproducer.exe> and expect hits on:
     • encode data using Base64
     • decode data using Base64 in .NET
     • load .NET assembly
     • invoke .NET assembly method
     • access .NET resource
     • check if file exists
   • Compare to this sample's capa.txt — should match 5+ capabilities.

Deployable Signatures

YARA rule

rule avalancherunner_game_masquerade {
    meta:
        description = "AvalancheRunner .NET game-masquerade loader with encrypted CLR resources"
        author = "triage-pipeline"
        date = "2026-06-09"
        hash = "1a38a9488cb0c8b1cd817fa2c8bc854eb1a77ebc3adf94a75dbf5d8a4c5bb045"
    strings:
        $s1 = "AvalancheRunner" ascii wide
        $s2 = "Ko'chki Chopari O'yini" ascii wide
        $s3 = "Antigravity" ascii wide
        $s4 = "hHRu.exe" ascii wide
        $s5 = "Survey_Cadastral_Transect" ascii wide
        $s6 = "Shifrlash" ascii wide
        $s7 = "Deshifrlash" ascii wide
        $s8 = "ObfKalit" ascii wide
        $s9 = "AvalancheRunner.OyinFormasi.resources" ascii wide
        $s10 = "AvalancheRunner.NatijaFormasi.resources" ascii wide
        $guid = "a8b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c" ascii wide
        $net1 = ".NETFramework,Version=v4.5" ascii wide
        $net2 = "System.Resources.ResourceReader" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($s1 or $s4 or $guid) and
        (2 of ($s5, $s6, $s7, $s8)) and
        (1 of ($s9, $s10, $net2))
}

Behavioral hunt query (Sigma-like)

Since no dynamic data exists, this is a static-behavioral fingerprint for endpoint or EDR hunts targeting the loader pre-detonation:

title: .NET Game-Masquerade Loader with Encrypted Resources
logsource:
  product: windows
detection:
  selection_pe:
    - FileName|endswith: '.exe'
    - pe_header|contains: 'PE32'
  selection_strings:
    - strings|contains:
      - 'AvalancheRunner'
      - 'Bank_Payment_Advice'
      - 'Shifrlash'
      - 'Deshifrlash'
      - 'ObfKalit'
      - 'Survey_Cadastral_Transect'
  selection_dotnet:
    - strings|contains|all:
      - 'System.Resources.ResourceReader'
      - '.NETFramework,Version=v4.5'
      - 'mscoree.dll'
  condition: selection_pe and selection_strings and selection_dotnet
falsepositives:
  - Unlikely; the string combination is highly specific.
level: high

IOC list

Behavioral fingerprint statement

This binary presents itself as a .NET Framework 4.5 GUI application with version-info claiming a legitimate game identity (AvalancheRunner). On launch, it accesses a large embedded CLR resource stream (~950 KB), decrypts it via managed Base64 and custom cipher routines (Shifrlash/Deshifrlash), and reflectively loads the resulting assembly into memory without writing to disk. No native API imports are present in the outer binary; all malicious behavior is deferred to the second-stage payload. The UI language is Uzbek and the filename is a banking-themed lure (Bank_Payment_Advice*.exe), indicating targeting of Uzbek-speaking victims via social engineering.

Detection Signatures

References

• Wiki entity: avalancherunner
• Related concept: dotnet-manifest-resource-decryption
• Related technique: version-info-masquerade
• Umbrella entity: unclassified-pe32-dotnet
• Artifact ID: b3bf0c45-3788-4966-a491-41f1e88acdd5 (OpenCTI) ^[metadata.json:2]

Provenance

Analysis derived from:

• file.txt (file(1) output)
• exiftool.json (ExifTool 12.76 VS_VERSIONINFO parse)
• pefile.txt (pefile Python library DOS/NT/section/imports/resources parse)
• strings.txt (strings(1) ASCII/Unicode extraction)
• floss.txt (FireEye flare-floss — failed due to CLI arg typo, no decoded strings recovered)
• capa.txt (Mandiant flare-capa v7 static analysis)
• binwalk.txt (binwalk signature scan)
• rabin2-info.txt (radare2 rabin2 -I header summary)
• metadata.json (OpenCTI artifact metadata)
• triage.json (triage pipeline classification)
• radare2 level-4 analysis + dnfile CLR metadata parse

No CAPE detonation was performed (status: skipped — no Windows guest available). All behavioral claims are static inferences. Reflective-loading and C2 claims carry higher uncertainty pending dynamic execution.