Football Manager 26 Crack Hides Two-Year-Old AutoIT Kill Chain

A Football Manager Crack Conceals a Two-Year-Old AutoIT Kill Chain

Since CTX Team's earlier coverage of this campaign, nine additional file indicators have surfaced, deepening the tooling picture around a multi-stage infection chain that pairs trojanized game installers with a layered evasion stack that has remained structurally intact across at least two years of active operation. The newest sample — a 20.6 MB executable named fm.exe carrying Unity Technologies copyright metadata and the embedded path C:\Games\Football Manager 26\fm.exe — represents the operator's freshest social-engineering pivot: from a generic Windows-update masquerade in 2023 to a Football Manager 26 crack in late 2025. The toolchain underneath it has barely changed.

The campaign is attributed to Patchwork — also tracked as Dropping Elephant, APT-C-09, Monsoon, and Quilted Tiger — an actor whose stated motivation is espionage. The presence of an XMRig Monero miner as the observed final payload is analytically interesting: it may reflect opportunistic resource abuse layered on top of intelligence-collection objectives, or the miner may serve as a cover payload to obscure a primary espionage purpose. Current evidence does not resolve that question, and the attribution itself carries medium confidence given the data available.

What the nine new indicators do resolve is the operational continuity of the build pipeline, the certificate-forgery technique used on the miner payload, and the BYOVD kernel-driver component that underpins the chain's privilege-escalation step. Each of those three elements carries independent forensic weight; together they describe an operator who refreshes lure context while keeping the underlying toolset deliberately stable.

The AutoIT Build Pipeline That Refused to Change

The forensic anchor of this update is a two-file cohort bound by imphash 161c85364c462057ba28801ac1ad5404, rich PE header hash 637a2ef75635800bca62e24120fdbe60, and an identical PE entry-point offset of 195100. One member of that cohort is CheckUpdate.exe, first submitted to VirusTotal on 2023-04-10, a 1.1 MB AutoIT-compiled dropper that posed as a Windows update utility and resided at C:\WINDOWS\SysWOW64\CheckUpdate.exe. The other is fm.exe, first seen on 2025-12-06, a 20.6 MB variant that inflates its on-disk footprint by packing a near-20 MB .rsrc section — entropy 7.98 — almost certainly to defeat size-based heuristics or to bundle additional payload stages within the resource block.

The YARA rule AutoIT_Compiled co-fires on both samples, corroborating the imphash linkage and confirming that AutoIT has been the consistent scripting and compilation framework across campaign iterations spanning more than two and a half years. Identical section layout — .text, .rdata, .data, .pdata, .rsrc, .reloc — appears in both binaries, with the .rsrc section carrying the highest entropy in each case (7.58 in the 2023 dropper, 7.98 in the 2025 variant). That entropy gradient is the signature of compressed or encrypted embedded content executed via the AutoIT runtime [T1059].

The 2023 dropper carries three YARA hits: AutoIT_Compiled, Base64_Encoded_URL, and Windows_API_Function. The Base64_Encoded_URL rule fires on the presence of Base64-encoded URI prefixes, indicating the 2023 sample decodes and fetches secondary payloads at runtime — a retrieval step absent or not yet observed in the 2025 variant's rule profile. Both samples are tagged detect-debug-environment and long-sleeps, consistent with T1497.002 and T1497.003 sandbox-evasion behaviour. The 2025 fm.exe adds a calls-wmi tag, generating a critical-severity Sigma hit among its ten total Sigma rule matches — four high, three medium, two low, one critical — and Zenbox classifies it as an EVADER with confidence 72, a designation that reflects active anti-analysis behaviour observed during sandbox execution.

Detection coverage for both droppers sits in the 40–48 of 76 range. The 2023 CheckUpdate.exe scores 40/76, with notable misses including Kaspersky, Fortinet, DrWeb, and ClamAV. The 2025 fm.exe reaches 48/76 but still evades SentinelOne, AhnLab-V3, Cynet, and twenty other engines. The static detection gap is not trivial: roughly a third of the engine set fails to flag either sample, and the 2023 dropper returned zero malicious verdicts in its single available sandbox run despite its 40/76 static score — a reminder that imphash-level build continuity does not automatically translate into behavioural detection.

The size inflation in the 2025 variant deserves particular attention. The 2023 dropper is 1.1 MB; the 2025 variant is 20.6 MB — an eighteen-fold increase driven almost entirely by the .rsrc section growing from 220 KB to just over 20 MB. This is a documented technique for defeating cloud-based sandboxes and some AV engines that skip analysis of executables above a size threshold. The operator appears to have deliberately engineered this growth between iterations, while keeping the PE entry-point, section layout, and import-table hash identical — a calculated trade-off between detection evasion and build-pipeline stability.

Certificate Forgery and the Fake Microsoft Telemetry Binary

The XMRig payload — CompatTelRunner.exe, SHA-256 425bd46630cde2d2efe3d05ee61dd54cd1dd3fc381f547c90d7a70c95b72b572 — presents one of the more technically deliberate certificate-forgery specimens in this dataset. The file carries a code-signing certificate whose subject name is "Microsoft Windows", whose issuer is also "Microsoft Windows", and whose serial number is the single byte 01. The certificate was minted on 2023-02-26 and carries a three-year validity window through 2026-02-25, but the chain terminates in an untrusted root: the signing verdict reads "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider." The thumbprint is 448AB328FCCE85C6B980CB60CD3FF3B95D70CF8A.

This is not a stolen or abused legitimate certificate — it is a fabricated self-signed credential constructed to mimic the appearance of a Microsoft-signed binary in process trees and file-property dialogs. The internal name, original name, product string, and copyright field all read as authentic Windows telemetry metadata: CompatTelRunner.exe, "Microsoft® Windows® Operating System", "© Microsoft Corporation. All rights reserved.", file version 10.0.19645.1029 (WinBuild.160101.0800). The signing date of 2023-11-19 postdates the certificate's issuance by roughly nine months, suggesting the certificate was prepared in advance and applied when the payload was finalised [T1036].

Three sandboxes return unanimous malicious verdicts for this file: C2AE classifies it as CryptoCurrencyMiner and XMRminer; CAPE Sandbox as CoinMiner02; Zenbox as Xmrig with EVADER classification. Six YARA rules fire, including MAL_XMR_Miner_May19_1 (Florian Roth, Nextron Systems, targeting Monero miners) and MALWARE_Win_CoinMiner02 (ditekSHen). Detection sits at 48 of 76 engines, with Microsoft, AhnLab-V3, SentinelOne, and approximately seventeen other engines still missing the file. The .pdata section registers entropy 8.0 — the maximum value — consistent with packed or encrypted exception-handling data, though the imphash for this file (245a2aa2df86a6ab3925180c93315f2b) shares no lineage with the AutoIT dropper cohort, confirming it was built on a separate toolchain.

The masquerade extends to the file's deployment path: alt-names include C:\WINDOWS\SysWOW64\CompatTelRunner.exe and C:\Windows\SysWOW64\CompatTelRunner.exe, placing it in the same system directory as the AutoIT droppers and the zero-detection XML persistence files. A process tree showing CompatTelRunner.exe running from SysWOW64 would not immediately alarm an analyst unfamiliar with the legitimate binary's expected location — which is C:\Windows\System32\CompatTelRunner.exe on a standard Windows installation, not the 32-bit compatibility path.

The LOLDriver That Outlived Its Certificate by Seventeen Years

WinRing0x64.sys — SHA-256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 — is the campaign's kernel-access component, and its detection profile is the starkest number in this entire dataset: 4 of 76 engines flag it, while 66 return clean verdicts. Only Cylance, DrWeb, Microsoft, and Rising raise an alert. The community reputation score is -430, derived from 91 malicious votes against 56 harmless — a community that clearly recognises the driver's abuse potential even as the majority of AV engines do not act on it.

The driver carries a legitimate code-signing chain: subject Noriyuki MIYAZAKI, issued by GlobalSign ObjectSign CA, with the full chain running through GlobalSign Primary Object Publishing CA to GlobalSign Root CA - R1. The signing date is 2008-07-26. The leaf certificate was valid from 2007-09-24 to 2008-09-24 — a one-year window that expired more than sixteen years before the most recent VirusTotal submission on 2026-06-09. The revocation status is listed as unknown or offline across all intermediate certificates, meaning revocation checking cannot definitively invalidate the chain on systems that fail open. The YARA rule PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD (Florian Roth, signature-base) confirms the LOLDrivers catalogue match, identifying this as the WinRing0 / WinRing0x64 vulnerable driver.

WinRing0 provides direct hardware and kernel-memory access through a set of IOCTL interfaces. In the context of a cryptominer deployment, the canonical use pattern is to load the driver to gain kernel-level privileges [T1543.003], then use that access to disable or blind security products before deploying the miner — a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique that exploits the fact that the driver carries a legitimate, if expired, GlobalSign signature. On systems without strict driver-signing enforcement or without Vulnerable Driver Blocklist policies enforced, the driver loads without complaint.

The file has accumulated 29,438 submissions from 3,663 unique sources since its first appearance on 2026-06-09 — a submission volume that reflects both the driver's legitimate origins as an open-source hardware-access library and its widespread abuse across multiple unrelated threat clusters. Its presence in this campaign cluster is operationally significant not because it is novel — it is not — but because its continued viability as a kernel-access mechanism in 2025 and 2026 speaks to the persistent gap between community recognition (91 malicious votes) and automated detection (4/76). The driver's imphash (d41fa95d4642dc981f10de36f4dc8cd7) shares no lineage with any other file in the campaign set, consistent with it being a pre-built component dropped from an external source rather than compiled within the same build environment as the AutoIT droppers.

The Infection Chain: From Game Crack to Kernel Access to Mining Pool

The attack mechanism chain documented across the nine new indicators follows a five-stage architecture that has remained consistent between the 2023 and 2025 campaign iterations.

Initial access relies on masquerading [T1036]. The 2025 dropper presents as a Football Manager 26 crack: fm.exe carries Unity Technologies copyright metadata ((c) 2005-2025 Unity Technologies. All rights reserved., file version 6000.0.52.8888375) and the embedded path C:\Games\Football Manager 26\fm.exe, constructing a plausible game-executable identity for a user who has downloaded what they believe is a cracked copy of the game. The 2023 predecessor used a different social-engineering context — a Windows update utility at C:\WINDOWS\SysWOW64\CheckUpdate.exe — but the same underlying AutoIT binary structure. Both lures target users operating outside legitimate software distribution channels, whether through pirated game repositories or unofficial update utilities.

Execution proceeds through the AutoIT runtime [T1059]. The dropper unpacks payload content from its high-entropy .rsrc section — entropy 7.58 in the 2023 variant, 7.98 in the 2025 variant — and executes it. The 2023 dropper's Base64_Encoded_URL YARA hit indicates it additionally decodes and fetches secondary content from remote URLs at runtime, a retrieval step that allows the operator to update downstream payloads without recompiling the dropper. Both samples implement anti-analysis behaviour through debug-environment detection and extended sleep calls before executing their primary logic, consistent with T1497.002 and T1497.003. The 2025 fm.exe additionally invokes WMI (calls-wmi tag), which may serve system-enumeration purposes [T1082] or be part of a process-spawning mechanism to launch subsequent stages with reduced visibility.

Persistence is established — and here the evidence basis shifts from confirmed to inferred — through two XML files dropped to C:\Windows\SysWOW64\: MicrosoftWindows.xml (SHA-256 9521a9c196352c105cf5f811a2eca169f004894ebd32fb03bdae91925dd0ac04, first seen 2023-08-10, 0/75 detection) and MicrosoftWindowsold.xml (SHA-256 a705ba2707c6b47cf06c3f13b3cf6425e283f3247a0dc27b79fc00ad12f631a5, first seen 2023-08-10, 0/75 detection). Both are 4 KB XML documents with UTF-16 encoding and CRLF line terminators — a format consistent with Windows Task Scheduler task definition files [T1053.005]. Their placement in the same SysWOW64 directory used by the malicious EXEs, combined with T1053.005's explicit presence in the campaign's MITRE metadata, points toward scheduled-task persistence. Neither file has received a sandbox verdict, and no rule match confirms their function — the persistence role is inferred from context rather than directly observed.

Privilege escalation follows via BYOVD. WinRing0x64.sys is loaded to gain kernel-level access, exploiting its expired but structurally valid GlobalSign signature to pass driver-loading checks on systems without enforcement of the Vulnerable Driver Blocklist. The driver's community reputation of -430 reflects widespread recognition of this abuse pattern, but its 4/76 AV detection rate means automated endpoint controls largely ignore it. The expected operational sequence — load driver, use kernel access to disable or blind security products, then deploy the miner — is consistent with documented BYOVD patterns for cryptominer campaigns, though the specific security-product targeting in this instance is not directly confirmed by the available sandbox data.

The final stage is XMRig Monero mining [T1496]. The payload deploys as CompatTelRunner.exe with its fabricated Microsoft Windows certificate, connecting to the nanopool.org public mining pool for pool-based Monero mining. The IDS rules ET POLICY Cryptocurrency Miner Checkin and ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) (both Proofpoint Emerging Threats Open) fire during sandbox execution of the 2025 fm.exe, confirming active pool check-in traffic during the dropper's execution cycle. Two of three sandboxes return malicious verdicts for the 2025 dropper, with CAPE Sandbox naming CoinMiner02 and Zenbox naming Xmrig. The use of nanopool.org as the C2 endpoint is operationally significant: it places the miner's outbound traffic within a pool of legitimate cryptocurrency mining traffic, complicating network-layer detection and making IP-based blocking ineffective. The operator has no actor-controlled C2 infrastructure to take down or sinkhole — the mining pool itself is the endpoint.

Outliers, Gaps, and the Question of the PEM Certificate

Three components in the campaign set sit structurally isolated from the AutoIT cohort and warrant separate treatment.

The packed trojan suf_launch.exe — also known as WindowsUpdateBox.exe, internal name bluestub, SHA-256 6910db0a0f1caab9effe65c01484b8b5dea89325081b71e7ad3c1cb8fc401d07 — carries a PE timestamp of 2019-01-03, predating the campaign's other components by four years. It is packed with Varist, a different obfuscation technique from the AutoIT cluster, and its YARA hit (SUSP_XORed_MSDOS_Stub_Message, Florian Roth) indicates XOR-obfuscated MSDOS stub content — again distinct from the AutoIT pipeline. Zenbox classifies it as Xmrig with confidence 64, and it scores 49/76 static detection. Its imphash (838dd9fbdbb409224ad0e13122a109ae) shares no lineage with any other campaign file. The bluestub internal name and the 2019 PE timestamp suggest this may be an older-generation loader or a separately sourced component reused opportunistically, rather than a product of the same build environment that produced the AutoIT droppers. Its role in the chain — whether as an alternative dropper, a second-stage loader, or simply a co-located tool — cannot be determined from available data.

The PEM certificate file mswindows.crt (SHA-256 6e8bb7a07acf14bf7c9ca6676d79c128ae37979a7ca00f3896782a18a142f094, first seen 2025-04-01, 0/78 detection) is the most analytically provocative outlier in the set. Its alt-names place it in user temp directories — c:\users\oqxzraykm\appdata\local\temp\mswindows.crt, %TEMP%\aut8d56.tmp — suggesting it was dropped during an infection rather than pre-positioned. The file shares no imphash, signer, or threat label with any other campaign sample. Its naming convention — mswindows.crt — mirrors the fabricated "Microsoft Windows" signer identity used on the XMRig payload. The analyst assessment is that this file may represent a custom root certificate being installed to the Windows trust store in order to legitimise the forged Microsoft Windows signing chain used by the XMRig binary — a step that would cause the certificate chain to resolve as trusted rather than terminating in an untrusted root. That role, however, cannot be confirmed from the available data: there are no sandbox verdicts for this file, no rule matches, and only a single submission from a single source. It warrants close examination if additional samples from this cluster surface.

The data-quality picture for this update is honest about its limits. Three of the eight dossier files with full metadata lack sandbox verdicts; three lack imphash data; four lack signature information. Seven rows in the indicator catalog carry no detection ratio, type, or threat label at all. The overall pack-level confidence score is 29 out of 100 — low. Behavioural claims for the XML persistence files and the PEM certificate are entirely inference-based. The AutoIT dropper CheckUpdate.exe (19ef6b…) returned zero malicious verdicts in its single sandbox run despite 40/76 static detections, which limits confidence in any behavioural characterisation of that specific sample. These gaps do not undermine the core findings — the imphash cohort, the certificate-forgery technique, and the LOLDriver component are all directly evidenced — but they do mean that several elements of the chain's architecture remain inferred rather than sandbox-confirmed.

What Two Years of Build-Pipeline Stability Signals

The most analytically significant observation in this update is not any individual technique — BYOVD, certificate forgery, and AutoIT-compiled droppers are all documented patterns — but the combination of their persistence and the operator's evident decision not to rebuild.

The imphash 161c85364c462057ba28801ac1ad5404 binding CheckUpdate.exe (2023-04-10) and fm.exe (2025-12-06) is a two-year fingerprint on a single build environment. The operator changed the lure — from a Windows-update masquerade to a Football Manager 26 crack — but did not change the compiler settings, the section layout, the PE entry-point, or the rich PE header hash. That is a choice, not an oversight. Rebuilding an AutoIT dropper from scratch would take hours; the decision to reuse the same build template across a two-year operational window suggests either that the operator assessed the detection risk as acceptable, or that the build environment itself is constrained in ways that make rebuilding impractical.

The size inflation from 1.1 MB to 20.6 MB between the 2023 and 2025 variants is the one visible adaptation — a targeted response to size-based heuristics rather than a structural rebuild. The operator appears to have identified a specific detection mechanism and patched around it while leaving everything else intact. That is consistent with a mature operational posture: iterate on what gets caught, preserve what doesn't.

The nanopool.org mining pool as the sole confirmed C2 endpoint is a deliberate infrastructure choice that trades actor-controlled flexibility for detection resistance. An operator running a custom C2 server accepts takedown risk, sinkholing risk, and IP-blocklist exposure. An operator routing miner traffic through a public pool accepts none of those risks — the pool is not going to be taken down, its IP ranges are not going to be blocklisted without collateral damage to legitimate miners, and the DNS query to nanopool.org blends into any network that has cryptocurrency-related traffic. The trade-off is that the operator cannot issue arbitrary commands to infected hosts through the pool channel, which is consistent with a campaign whose confirmed final-stage objective is resource abuse rather than interactive intrusion.

The WinRing0 driver's continued operational viability — 4/76 detection despite 29,438 submissions and a community reputation of -430 — is a structural problem that this campaign is exploiting but did not create. The driver's legitimate GlobalSign signature, its expired-but-unrevoked status, and the absence of consistent Vulnerable Driver Blocklist enforcement across the installed base of Windows endpoints means that a kernel-access component first catalogued as a LOLDriver years ago remains a practical privilege-escalation tool in 2025 and 2026. The operator's decision to include it in this chain reflects a rational assessment of the detection landscape, not a novel technical insight.

If the mswindows.crt PEM file does represent a custom root certificate installation, it would signal an escalation in the campaign's trust-manipulation ambition — moving from a fabricated self-signed certificate that fails chain validation to a persistent trust-store modification that would cause the chain to resolve as fully trusted on the infected host. That step would meaningfully expand the operator's ability to deploy additional signed payloads without triggering certificate-chain warnings, and would represent a qualitative shift in the campaign's evasion architecture. The single-submission, zero-detection status of that file means the signal is weak; but the naming convention, the temp-path alt-names, and the timing relative to the XMRig payload's first appearance make it a component worth tracking carefully in any future samples attributed to this cluster.

The population most directly exposed to this campaign's delivery mechanism — pirated game installers and unofficial Windows update utilities — is not a narrowly defined enterprise sector. It is any endpoint environment where users have the ability to download and execute unsigned software from informal distribution channels, which in practice means a very wide surface. The operator's two-year commitment to the same build pipeline, combined with the layered evasion stack, suggests a threat actor who has found a working formula and sees no compelling reason to abandon it.