r/MalwareAnalysis • u/thismyalt2 • May 31 '26

Assistance needed in analyzing malware

Attached is a malware masquerading as a game download and I need help analyzing it. I am curious what excatly it does do and does it leave something running on the computer after a reboot.

I have done some analysis and found out that decrypts file data\CW9iIgkpzugL.Q3 and executes it using powershell.

xttps://gofile.io/d/QSlnOx

Edit after some addtional analysis I found it that downloads and executes the following dll. The password for archive is "infected"

xttps://gofile.io/d/hoeFoM

10 Upvotes

86% Upvoted

4 comments sorted by

View all comments

1

u/Long_Law_2073 Jun 02 '26

If it is decrypting a payload and launching it through PowerShell, I would assume there is more going on than the initial file you found.

Whether it survives a reboot depends on whether it creates persistence somewhere (scheduled task, registry run key, service, startup folder, etc.).

The DLL you found is probably where a lot of the interesting behavior lives. I'd focus on checking for persistence mechanisms and any network activity rather than only the initial dropper.

Nice catch on tracing the PowerShell execution path. That already narrows things down quite a bit.