unclassified-dotnet-game

Overview

A cluster of .NET Framework 4.5 WinForms GUI executables that present themselves as Uzbek-language arcade games (notably AvalancheRunner / Ko'chki Chopari O'yini) but are distributed under banking-themed filenames such as Bank_Payment_Advice20396.exe. Static analysis reveals no observable malicious behavior beyond the social-engineering masquerade. The binaries contain local XML high-score storage, simple XOR+ROL string obfuscation, and no network or persistence APIs.

Build Stack

• Language / runtime: C# targeting .NET Framework 4.5 (CLR v4.0.30319)
• Compiler / toolchain: Microsoft C# compiler (Roslyn or csc.exe) bundled with Visual Studio / MSBuild; standard WinForms designer-generated code
• Packaging: Plain PE32 with 3 sections (.text, .rsrc, .reloc); no packer, no obfuscator, no Authenticode signature
• Anti-analysis: None (no debugger checks, no VM detection, no sandbox evasion)
• Embedded resources: PNG game assets, XML application manifest, localized .resources files

Deploy / TTPs

• ATT&CK: None confirmed statically. Capa flags T1140, T1027, T1620, T1083 — all benign .NET runtime artifacts (Base64 DataSet serialization, XOR+ROL local obfuscation, normal JIT loading, File.Exists check).
• Persistence: None observed
• C2 / exfiltration: None observed — no System.Net, WebClient, HttpWebRequest, Socket, Mail, or Process.Start references
• Lateral movement: None observed
• Masquerade technique: Banking/finance filename mismatch against game version-info metadata

Variants / Aliases

• AvalancheRunner (product name)
• hHRu.exe (internal name)
• Ko'chki Chopari O'yini (Uzbek comment string)

Notable Analyses

• 1a38a948 — Full static deep-dive (report linked above). No CAPE detonation (no Windows guest).

Capabilities

• dotnet-winforms-gui-masquerade
• local-xml-data-persistence
• xor-rol-string-obfuscation
• banking-filename-social-engineering
• no-network-api-surface

Related

• version-info-masquerade — broader concept of VS_VERSIONINFO field abuse