Deep Analysis — 2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b

1. Build / RE

Toolchain & Language

Compiled with Visual Studio 2022 v17.4.4 for .NET Framework 4.5 (v4.0.30319). The PE is a 32-bit GUI executable with a single import (mscoree.dll._CorExeMain) and standard three-section layout (.text ~1012 KB, .rsrc ~1.5 KB, .reloc ~512 bytes) ^[pefile.txt] ^[rabin2-info.txt]. No packing, no native packer stub, no ConfuserEx, SmartAssembly, or Xenocode obfuscation.

Symbol Recovery

Radare2 exports 110 managed symbols with zero mangling. Full namespace AvalancheRunner recovered intact, including classes:

• AvalancheRunner.OyinFormasi (game form)
• AvalancheRunner.NatijaFormasi (results form)
• AvalancheRunner.ToshMexanikasi (rock mechanics)
• AvalancheRunner.OyinMantiqi (game logic)
• AvalancheRunner.XavfsizHisoblagich (security calculator — encrypt/decrypt routines)
• AvalancheRunner.NatijaBoshqaruvchi (results manager — data-table persistence)
• AvalancheRunner.KattaMalumotlar (big data — typed DataSet)

^[r2:exports] ^[ghidra:symbol_search]

Anti-Analysis

None observed. No debug checks, no VM detection, no anti-disassembly, no TLS callbacks. The binary is fully unobfuscated and analyst-friendly.

Embedded Resources

Two CLR resources identified by pefile:

• AvalancheRunner.Properties.Resources.CKT — 952 KB, identical size to the encrypted blob in sibling 1a38a948 ^[pefile.txt]
• AvalancheRunner.Properties.Resources.DBzt — 24 bytes (likely a small config or key fragment)

The 952 KB blob is the primary payload carrier. Its size match to the first sibling suggests the same second-stage payload or a very similar build pipeline.

Notable Functions

Survey_Cadastral_Transect (addr 00402334) — main game-loop / payload-orchestration routine. Decompilation fails into x86 junk because the body is managed IL; Ghidra mis-interprets IL as native x86. The function name itself is a bizarre English-Uzbek hybrid masquerading as a survey/cadastral term, consistent with the first sibling's pattern of mixing unrelated technical jargon into game-logic namespaces ^[ghidra:Survey_Cadastral_Transect].

Shifrlash / Deshifrlash (addr 00405160 / 004051a0) — managed encrypt/decrypt functions inside XavfsizHisoblagich ("Security Calculator"). Decompilation similarly collapses into x86 noise, but the symbol names confirm the same custom cipher as the first sibling. No Base64 or AES constants recovered in static strings; the cipher is likely a simple XOR or Vigenere loop using the ObfKalit (obfuscation key) ^[ghidra:Shifrlash] ^[floss.txt].

OmonQolishVaqti ("Survival Time") — getter/setter for the game timer, also referenced in the results DataSet schema ^[strings.txt:1482] ^[strings.txt:1483].

Code Quality & Signing

Unsigned. Version info fields are empty (FileVersion 0.0.0.0, CompanyName blank, ProductName blank) except for InternalName and OriginalFilename both set to LHUS.exe ^[exiftool.json] ^[pefile.txt]. No Authenticode certificate, no timestamp counter-signature. The VS_VERSIONINFO block is minimal and does not masquerade as a legitimate vendor — unlike the first sibling which claimed "Antigravity" as CompanyName.

2. Deploy / ATT&CK

Ground truth: No CAPE detonation present (PE skipped — no Windows guest). All TTPs below are inferred from static evidence.

Persistence / C2 / Lateral Movement

No persistence mechanisms observed (no registry keys, no schtasks strings, no startup folder references, no service creation) ^[strings.txt] ^[floss.txt].

No network indicators (no HTTP, TCP, UDP, DNS, SMTP, or socket strings) ^[strings.txt] ^[floss.txt].

No process injection, hollowing, or remote-thread strings ^[strings.txt] ^[floss.txt].

No lateral-movement capabilities observed statically.

Attribution

• Language: All UI strings and class names are in Uzbek (OyinFormasi, NatijaFormasi, ToshMexanikasi, OmonQolishVaqti, YulduzlarniYarat, etc.) ^[strings.txt] ^[floss.txt].
• Code reuse: Same namespace layout, same class names, same encrypted resource blob size (~952 KB), same Shifrlash/Deshifrlash cipher routines, and same bizarre Survey_Cadastral_Transect function name as sibling 1a38a948. This is a direct sibling — likely rebuilt from the same source tree or compiled from the same Visual Studio project with only the Output Filename changed to LHUS.exe.
• Build delta: 2.5 years newer (Dec 2022 vs May 2020), Visual Studio 2022 vs VS 2019/16.10, identical .NET Framework 4.5 target. The only meaningful surface delta is the version-info stripping (no "Antigravity" CompanyName) and the filename change.

3. Comparative Notes (Sibling 1a38a948)

The near-identical resource blob size strongly suggests the same second-stage payload or the same payload-generation pipeline. If the blob content hashes match, these two samples are effectively the same weapon with a recompiled wrapper.

4. Verdict

Low-confidence malicious family label (AvalancheRunner) maintained. The outer binary is a .NET WinForms game with Uzbek UI, but the encrypted 952 KB CLR resource blob, the custom managed cipher, and the banking-themed delivery context of the first sibling justify treating this as a loader/dropper masquerading as a game. No new TTPs versus the first sibling; this is a rebuild.