Trojanized Black Myth: Wukong Launcher Delivers Rancor Trojan to Thai Users

A Trojanized Game Launcher, a Three-Year-Old Domain, and Three Layers of Evasion

A 457-kilobyte Windows executable named "Launcher Black Myth Wukong.exe" is circulating in Thailand, masquerading as the Steam launcher for one of 2024's most widely played game titles — and carrying a Rancor-family trojan payload that 52 of 76 antivirus engines now flag as malicious while the Zenbox sandbox returns a clean verdict at 98% confidence. The gap between those two numbers is the story: the operators behind this campaign did not rely on a single evasion trick. They layered three distinct techniques — a high-profile gaming lure, a PE compile timestamp backdated by approximately 22 months, and active sandbox-detection logic — into a stack designed to pass automated analysis environments while remaining broadly detectable by static engines. The C2 infrastructure behind the payload reflects the same deliberate patience: a domain registered in February 2023, aged for over three years before active use, now proxied through Cloudflare with a wildcard TLS certificate that positions the operator to rotate subdomain channels without generating new certificate-issuance events. CTX Team tracks this activity under campaign identifier CTXws6rrg2c33, attributed to the threat actor Snowglobe — also tracked as Animal Farm and Sig20 — with espionage assessed as the sole motivation.

The Gaming-Lure Entry Point: Black Myth: Wukong as Social Engineering

The payload's delivery mechanism exploits the cultural momentum of a specific title. Black Myth: Wukong, released in August 2024, became one of the fastest-selling action RPGs in Steam's history, generating a large and geographically distributed player base. The trojanized file carries the meaningful name "Launcher Black Myth Wukong.exe" and includes among its recorded alt-names both "Black Myth Wukong.exe" and a fully qualified Steam library path — "C:\Program Files (x86)\Steam\steamapps\common\BlackMythWukong\Black Myth Wukong.exe" — alongside a second path, "C:\Windows\l94qmh.exe", that suggests post-execution staging to a system directory. The Steam library path is particularly significant: it is not merely a filename mimicking the game, but a path that would appear plausible to any user browsing their own Steam installation directory or receiving a file from a peer who described it as a game component. This level of path specificity indicates the operator constructed the lure with knowledge of how Steam organises its library structure, targeting users who might accept a file described as a launcher or patch for an existing installation [T1204.002].

The threat record places the targeted region as Thailand, and the file was first submitted to VirusTotal on 2026-05-15, with the most recent submission on 2026-05-22 — a narrow three-submission, two-source window that suggests limited but targeted distribution rather than broad spam-style seeding. The absence of a code-signing certificate on the payload is notable in this context: a gaming-lure delivery model typically benefits from Authenticode signing to suppress Windows SmartScreen warnings, and the operator's decision to deploy an unsigned binary [T1204.002] suggests either a deliberate acceptance of that detection risk — perhaps because the delivery channel itself provides sufficient social-engineering cover — or an operational constraint that prevented certificate acquisition. The file's unsigned status is one of the few detection opportunities that the evasion stack does not address.

The Rancor family label — with popular engine names including "rancor", "tl0101eg26zy", and "gencirc" — places this payload within a trojan lineage associated with espionage-oriented intrusions. The campaign-level family attribution to "babar" links it further to the Babar implant family, a more capable backdoor associated with Snowglobe/Animal Farm operations. The MITRE technique set attached to this campaign — spanning process injection [T1055.011], Windows Command Shell execution [T1059.003], registry manipulation [T1012, T1112], inter-process communication via Dynamic Data Exchange [T1559.002], and a data-destruction capability flag [T1485] — is consistent with a full-featured espionage backdoor rather than a simple first-stage dropper. Whether the visible 457 KB executable represents the complete payload or merely the entry point of a multi-stage toolchain is a question current evidence cannot fully resolve, for reasons discussed below.

Three-Layer Evasion: Timestamp Falsification, Sandbox Detection, and Lure-Context Cover

The evasion architecture documented in this campaign is notable precisely because it operates at three distinct analytical layers simultaneously, rather than concentrating defensive effort at a single chokepoint.

The first layer is timestamp falsification. The PE compile timestamp embedded in the binary reads 2024-07-01 — approximately 22 months before the file's first recorded VirusTotal submission on 2026-05-15. This gap is consistent with deliberate timestomping [T1070.006]: the operator either compiled the binary in July 2024 and held it in reserve for nearly two years before deployment, or — more likely — compiled it closer to the deployment date and applied a backdated timestamp to complicate forensic timeline reconstruction. A genuine 22-month development-to-deployment gap is not impossible for a sophisticated actor managing a long-horizon operation, but the combination of a backdated timestamp with other deliberate evasion choices in the same binary makes the timestomping interpretation more operationally coherent. The practical effect is that any analyst attempting to anchor the campaign to a compilation timeline using PE metadata alone will be working from a falsified reference point.

The second layer is sandbox evasion. Despite 52 of 76 antivirus engines returning malicious verdicts — a detection ratio that places this file firmly in the "broadly known malicious" category for static analysis — the Zenbox sandbox environment returned a CLEAN classification at 98% confidence. This divergence between static consensus and dynamic verdict is the clearest evidence of active analysis-environment detection logic [T1622]. The binary appears to recognise characteristics of the Zenbox execution environment — whether through timing checks, hardware fingerprinting, process enumeration, or API call monitoring — and suppresses its malicious behaviour accordingly. The result is a file that a static AV scanner will flag immediately but that an automated sandbox pipeline may pass as benign, creating a meaningful gap in detection coverage for organisations that weight dynamic analysis heavily in their triage workflows.

The PE section layout provides some structural context for this behaviour. The primary .text section carries an entropy of 6.25 across 205,312 bytes, and the .itext section registers 5.4 entropy across 2,560 bytes — entropy levels consistent with moderately packed or obfuscated code but not the extreme compression (entropy above 7.5) that would indicate aggressive runtime unpacking. The .data section entropy of 3.84 and the near-zero .rdata entropy of 1.35 suggest that the payload's obfuscation is concentrated in the executable code sections rather than in data storage, which is consistent with a binary that carries its evasion logic inline rather than in a separately packed data blob. The import count of zero is also notable: a PE32 with no recorded imports typically resolves its API calls dynamically at runtime [T1106], which both complicates static import-table analysis and is consistent with the Native API usage flagged in the campaign's MITRE technique set.

The third evasion layer is the social-engineering context itself. An unsigned executable named after a popular game, delivered through a channel where the recipient expects game-related files, benefits from a form of cognitive cover that neither timestamp manipulation nor sandbox evasion provides: the victim's own reduced scrutiny. A user who has been told they are receiving a game launcher patch is less likely to examine the file's signing status or submit it to a sandbox before execution. This is not a technical evasion technique in the MITRE sense, but it functions as a detection-suppression layer at the human-analyst tier, and the operator's choice to combine it with the two technical layers suggests an awareness that the full detection stack includes human judgment as well as automated tooling.

The koodgame.com Infrastructure: Domain Aging, Cloudflare Proxying, and Wildcard TLS

The C2 infrastructure for this campaign is built around a single domain — koodgame.com — that exemplifies a deliberate reputation-laundering and traffic-obfuscation strategy. The domain was registered on 2023-02-20 via Namecheap (registrar ID 1068) with a fully privacy-protected registrant: the WHOIS record lists a registrant country of Iceland, a technical contact city of Reykjavik in the Capital Region, and an email address routed through the withheldforprivacy.com proxy service. The domain's expiry date is set to 2027-02-20, indicating that the operator paid for a four-year registration window from the outset — a long-horizon infrastructure investment that contrasts sharply with the short-registration-window patterns associated with opportunistic phishing infrastructure.

At the time of observed campaign activity, koodgame.com was 1,210 days old. Domain age is one of the most commonly applied heuristics in reputation-scoring systems: a domain that has existed for over three years without accumulating malicious verdicts will pass age-based filters that would catch a freshly registered lookalike. The domain scores 0/91 on VirusTotal — a clean reputation that stands in stark contrast to the 52/76 detection ratio of the payload it supports. This deliberate separation between a high-detection payload and a clean-reputation C2 node is a characteristic of operators who understand that network-layer defences and endpoint-layer defences are often evaluated independently, and who invest in maintaining clean infrastructure precisely to exploit that gap.

The domain resolves through Cloudflare nameservers — aryanna.ns.cloudflare.com and dave.ns.cloudflare.com — with A-records 104.21.22.228 and 172.67.207.142 both falling within Cloudflare's anycast address ranges. This proxying arrangement means that the true origin server hosting the C2 backend is not directly observable from DNS resolution: all traffic to koodgame.com passes through Cloudflare's reverse-proxy infrastructure before reaching the operator's actual server. For defenders attempting to identify and block the origin IP, Cloudflare proxying introduces a layer of indirection that cannot be resolved without either Cloudflare's cooperation or direct observation of traffic patterns that bypass the proxy. The MX records — eforward1 through eforward5.registrar-servers.com — point to Namecheap's email-forwarding service, consistent with a domain maintained for operational use rather than any legitimate business purpose.

The TLS certificate currently associated with koodgame.com (serial number b6770e0e5669f9ee133d775d4dcc6f2b) was issued by Google Trust Services under the WE1 intermediate CA, with a validity window of 2026-06-02 to 2026-08-31. The certificate carries a wildcard Subject Alternative Name — *.koodgame.com — in addition to the base domain. This wildcard SAN is operationally significant: it allows the operator to direct C2 traffic to any subdomain of koodgame.com (for example, update.koodgame.com, cdn.koodgame.com, or any dynamically generated subdomain) without requesting a new certificate for each subdomain. From a defender's perspective, this means that certificate-issuance monitoring — which can be an effective early-warning mechanism when operators request new certificates for new C2 subdomains — will not generate alerts for subdomain rotation under this wildcard. The operator can cycle through subdomain channels for C2 communication [T1071.001] through at least August 2026 without any new certificate events appearing in Certificate Transparency logs.

The certificate was issued on 2026-06-02, approximately 18 days after the payload's first VirusTotal submission on 2026-05-15. This timing suggests the certificate was provisioned in preparation for or shortly after the campaign's initial deployment, rather than being a long-standing certificate reused from a prior operation. The 90-day validity window is standard for Google Trust Services certificates and does not itself indicate operational urgency, but the issuance timing relative to the payload's first appearance is consistent with active campaign infrastructure management rather than dormant domain maintenance.

No IP infrastructure has been characterised alongside the domain, leaving koodgame.com as the sole pivot point for now. The two uncharacterised file hashes (discussed below) may correspond to additional C2 nodes or staging infrastructure not yet observed.

The Payload's Behavioural Architecture: From Execution to Collection

Reconstructing the attack chain from the available evidence requires combining the directly observed file characteristics with the MITRE technique set attached to the campaign record — a methodology that carries inherent uncertainty where sandbox behavioural logs are absent or suppressed, as they are here.

The entry point is user execution of the trojanized launcher [T1204.002]. Once running, the payload's zero-import PE structure suggests that API resolution happens dynamically at runtime [T1106], with the binary using Native API calls to interact with the Windows kernel without exposing a conventional import table to static analysis tools. The campaign's MITRE tags include both T1055 and T1055.011 (Extra Window Memory Injection), indicating that the payload injects code into a separate process — likely a legitimate Windows process — to mask its execution context and evade process-based detection. This injection technique uses the extra memory slots associated with Windows GUI objects, a method that is less commonly monitored than the more widely known CreateRemoteThread or WriteProcessMemory injection paths.

Command execution is handled through the Windows Command Shell [T1059.003], with inter-process communication via Dynamic Data Exchange [T1559.002] providing a channel for the injected code to interact with other processes or receive instructions. DDE-based IPC is a technique that exploits a legacy Windows messaging mechanism, and its presence in the technique set alongside process injection suggests a payload that is designed to operate across process boundaries rather than executing entirely within a single process context.

Defense evasion is layered across the execution timeline. The backdated PE timestamp [T1070.006] operates at the forensic-analysis layer, complicating post-incident timeline reconstruction. The sandbox-detection logic [T1622] operates at the dynamic-analysis layer, suppressing malicious behaviour when the execution environment matches known analysis characteristics. The campaign's MITRE set also includes T1562.001 (Impair Defenses: Disable or Modify Tools) and T1564.004 (Hide Artifacts: NTFS File Attributes) — though the latter is inferred from the family profile rather than directly confirmed by sandbox behavioural logs, and should be treated as a capability indicator rather than an observed behaviour.

Post-execution collection behaviour, as indicated by the MITRE technique set, includes registry queries [T1012] to enumerate installed software and system configuration, and system network configuration discovery [T1016] — consistent with an implant performing initial reconnaissance to characterise the compromised host before proceeding to targeted data collection. Registry modification [T1112] is also flagged, suggesting the payload may write to the registry for persistence or to conceal configuration data. C2 communication is directed to koodgame.com over HTTPS [T1071.001], with the wildcard certificate enabling subdomain-level channel flexibility as described above.

The presence of T1485 (Data Destruction) in the MITRE tag set deserves a specific caveat: this technique is listed in the campaign metadata and is part of the Babar family's documented capability profile, but it cannot be confirmed as an observed behaviour from current evidence. It may reflect the family's broader capability set rather than an action taken in this specific campaign. CTX Team notes this distinction explicitly — the evidence supports the capability attribution but not a confirmed impact-stage execution.

Two Dark Files and the Limits of the Visible Footprint

The campaign record lists three file hashes. One — SHA256 bbe87a01ff0a2cffddbed91835c53503ac68440eb0a4764482261e205ecf6a31 — is the characterised Rancor-family payload described throughout this article. The other two — fc1c80cbfd99d7c1f1e82207065d9f2c1ac2e37c0d7c2d96e17fa2cce2dd93c4 and c648702e3ef9ae14a396f7c1b995afc5830b3ad760c1c94f0f6589752c5dc660 — carry no metadata: no file type, no size, no detection ratio, no threat label, no submission date, no popular names. They are present in the campaign record but entirely opaque to analysis.

This gap is analytically significant. A three-file campaign record where two-thirds of the file footprint is uncharacterised means that the visible payload may be only one component of a more capable toolchain. The Babar family's known architecture — as reflected in its MITRE technique set spanning initial access, execution, defense evasion, collection, and a data-destruction capability — is consistent with a multi-stage design in which a first-stage loader delivers a more capable second-stage implant. If the two uncharacterised hashes correspond to a loader and a second-stage implant respectively, the 457 KB "Launcher Black Myth Wukong.exe" may function primarily as the entry point that establishes execution and performs initial sandbox-evasion checks before dropping or fetching the actual espionage-capable component. This interpretation is consistent with the sandbox-evasion behaviour observed: a first-stage loader that detects the Zenbox environment and suppresses further execution would produce exactly the CLEAN verdict at 98% confidence observed, while the second-stage implant — never dropped in the sandbox environment — would remain unanalysed.

The evidence confidence for this campaign is assessed at medium (score 42/100 by CTX Team's internal evidence-quality framework), reflecting the combination of one substantive file dossier, one clean-reputation domain, and two file hashes that remain entirely opaque. The imphash for the characterised file — 64d5956f8e5f3da53f356d429da98f61 — and its fuzzy hashes (vhash 0450a6665d1c0d5d1c051038z3212015z35z13z203dz; ssdeep 6144:lO4ljGwVqeexXKTAipYbVKV+h0LxxtqXb1p+nnQ3qDn8X8zXkGq0mv4vBZuzuJdj:lTrA8MYQXGnQaDng8zXvjdCADbD) provide pivot anchors for future clustering if additional samples surface, but no peer files sharing this imphash have been observed. The file is isolated — sharing no imphash, signer, or threat label with any other known indicator — which limits the cross-IOC linkage that would otherwise strengthen campaign-level confidence.

Snowglobe's Operational Patience and What the Campaign Architecture Signals

The threat record attributes this campaign to Snowglobe, also tracked as Animal Farm and Sig20, with espionage assessed as the sole motivation and Thailand as the targeted region. Current evidence is too thin to independently corroborate Snowglobe's state alignment or reconstruct a detailed prior-campaign narrative. What the evidence does support is a characterisation of the operational approach this campaign reflects — and that characterisation is instructive regardless of the attribution confidence level.

The most notable characteristic of this campaign is not any individual technique but the consistency of the operational patience it demonstrates across every layer. The domain was registered in February 2023 and aged for over three years before active campaign use — a timeline that implies either advance planning for a specific operation or a standing practice of maintaining aged infrastructure for deployment when needed. The domain registration runs through February 2027, meaning the operator has paid for a four-year window and is positioned to continue using koodgame.com as a C2 anchor for at least another eight months from the current observation window. The wildcard TLS certificate, valid through August 2026, extends the subdomain-channel flexibility through the same period without requiring new certificate events.

The PE timestamp backdating — whether it represents a genuine 22-month development cycle or a timestomping operation applied to a recently compiled binary — reflects the same discipline: an operator who considers forensic timeline reconstruction as an adversarial surface worth manipulating. The choice of a high-profile 2024 game title as the lure vector is similarly forward-looking: Black Myth: Wukong's cultural moment in the gaming community was predictable from its pre-release marketing, and a threat actor who prepared a trojanized launcher around the game's July 2024 release window (the PE timestamp date) would have been positioned to deploy it against a large and engaged player base at any point in the following two years.

The sector exposure implied by a gaming-lure delivery model is broader than it might initially appear. While the immediate at-risk population is Windows users in Thailand who interact with game distribution channels — Steam or third-party sites offering Black Myth: Wukong downloads — the espionage motivation listed in the threat record suggests the operator is not interested in the gaming community as an end target. Gaming lures are effective against a population that spans professional and personal computing contexts: a government employee, a financial-sector analyst, or a telecom engineer who plays games on a work-adjacent system is as reachable through a gaming-lure distribution channel as a dedicated gamer. The absence of any industry-specific targeting may reflect a deliberate approach that uses the gaming lure to reach individuals across sectors rather than concentrating on a specific vertical.

The two entirely uncharacterised file hashes represent the most significant analytical gap in the current picture. If they correspond to a loader and a second-stage implant — as the Babar family's multi-stage architecture would suggest — then the campaign's actual capability profile is considerably more capable than the visible Rancor-family entry point alone would indicate. The wildcard C2 infrastructure, the sandbox-evasion logic, and the long-horizon domain investment all point toward an operation designed for sustained access rather than a short-duration intrusion. An operator who ages a domain for three years, backdates a PE timestamp, and builds sandbox-detection logic into the entry-point payload is not optimising for a single-use operation. The architecture is built for persistence — and the two dark file hashes suggest that the most capable components of that architecture have not yet been fully characterised.