> Family · AvalancheRunner_

~/packetpursuit $ cat /intel/families/avalancherunner.md

typeentityconfidencelowcreated2026-06-09updated2026-06-16dotnetloaderdefense-evasionmasqueradingmitre-attckreflective-code-loading

AvalancheRunner

Low-confidence family label for a .NET Framework 4.5 PE32 binary cluster masquerading as games (AvalancheRunner, BombaZarasizlantiruvchi) while functioning as potential encrypted payload loaders. Three confirmed siblings span 2020–2026: 1a38a948 (May 2020, banking lure), 2d9f8c6e (Dec 2022, stripped version info), and f7352bc1 (May 2026, bomb-defusal skin with PDF masquerade). All share identical compiler toolchain, unobfuscated IL metadata, Uzbek-language WinForms UI, and the anomalous Survey_Cadastral_Transect method name.

Build Stack

Component Observation
Language C# / .NET Framework 4.5 (v4.0.30319)
Compiler Visual Studio 2019–2022 (16.10.0.0 / 17.4.4)
Obfuscator None — fully unobfuscated IL metadata
Signing Unsigned
Entry mscoree.dll._CorExeMain
Resources CLR embedded resource blob ~952 KB (PNG + zlib-compressed data) in siblings 1a38a948 and 2d9f8c6e; absent in f7352bc1

Variants / Aliases

  • AvalancheRunner (product name, siblings 1a38a948 and 2d9f8c6e)
  • BombaZarasizlantiruvchi (Uzbek "Bomb Defuser", sibling f7352bc1)
  • hHRu.exe / LHUS.exe / rFks.exe (internal names across siblings)
  • Ko'chki Chopari O'yini (Uzbek decoy string)

Deploy / TTPs

ATT&CK Tactic Technique Evidence
Defense Evasion T1140 — Deobfuscate/Decode Files or Information Managed Base64 decode + custom Shifrlash/Deshifrlash cipher routines (siblings 1a38a948, 2d9f8c6e)
Defense Evasion T1027 — Obfuscated Files or Information Encrypted CLR resource blob hides second-stage payload (siblings 1a38a948, 2d9f8c6e)
Defense Evasion T1620 — Reflective Code Loading Capa flags load .NET assembly + invoke .NET assembly method + access .NET resource (all siblings)
Discovery T1083 — File and Directory Discovery Capa check if file exists
Defense Evasion T1036 — Masquerading Version info claims game / PDF previewer; contradicts banking lure filename

Capabilities

  • dotnet-clr-resource-payload-hiding — ~952 KB encrypted/zlib-compressed blob inside CLR resources (siblings 1a38a948, 2d9f8c6e; absent in f7352bc1)
  • managed-base64-string-decoding — Capa-confirmed Base64 encode/decode in .NET
  • custom-managed-cipher-shifrlash — Encrypt/decrypt routines with hardcoded ObfKalit key (siblings 1a38a948, 2d9f8c6e; absent in f7352bc1)
  • reflective-dotnet-assembly-loading — Capa flags load .NET assembly and invoke .NET assembly method (all siblings)
  • version-info-masquerade — ProductName/FileDescription contradictions: AvalancheRunner vs banking filename; PDF FILE PREVIEWER vs .bat extension
  • uzbek-language-ui-decoy — All UI strings in Uzbek (Oyin, Tosh, Yulduz, Bomba, Sim, Kod, Galaba)
  • banking-filename-social-engineering — Bank_Payment_Advice20396.exe, z1EDG0012026051400140040_1669_pdf.bat
  • survey-cadastral-transect-anomaly — Recurring anomalous method name across all three siblings (2020–2026)
  • no-network-api-surface — No System.Net, WebClient, Socket, or HTTP references recovered statically (all siblings)

Notable Analyses

  • /intel/analyses/1a38a9488cb0c8b1cd817fa2c8bc854eb1a77ebc3adf94a75dbf5d8a4c5bb045.html — First sibling (May 2020, Bank_Payment_Advice20396.exe). Full static deep-dive. No CAPE detonation.
  • /intel/analyses/2d9f8c6e00839f7c513c080deb360c141eded1429ccadabf16fb2a8650e8436b.html — Second sibling (Dec 2022, LHUS.exe). Stripped version info, same encrypted CLR blob.
  • /intel/analyses/f7352bc1213a3464d7abb529acfdfb8a6e272e77a8e8f88236ca70192635d02d.html — Third sibling (May 2026, z1EDG0012026051400140040_1669_pdf.bat). Bomb-defusal skin, PDF-masquerade version info, no encrypted CLR blob, no Shifrlash/Deshifrlash routines.

Related