Susano Setup.exe

Summary

Sample identity

Loader family (4 builds observed)

Susano's landing page rebuilds the outer loader almost every day. Every build keeps the same wire protocol and the same config-table layout in .rdata but rotates the AES-256 master key, the CBC IV and the XOR mask that get compiled into the request-body prefix. We watched four distinct builds land inside a two-week window. Feature parity across all four (same target games, same anti-forensic list, same endpoint set) tells us they are the same product behind different cover.

Setup_1.exe (2026-07-15 build) is the freshest and the one used for full payload recovery. Everything from Payload architecture onward is sourced from that build's session with the origin server.

No protector on the outer shell

Nothing here matches the shape of a commercial protector. Sections have real names (.text / .rdata / .data / .pdata / .rsrc / .reloc / .fptable), .pdata holds real SEH unwind info, .reloc is populated, imports are a full-fat 150+ from KERNEL32 with real per-DLL function counts (not the one-stub-per-DLL pattern VMProtect uses). MSVC linker fingerprint matches Visual Studio 2022 (14.44). Entropy in .text is 7.3 which is high but explained by (a) three separate statically linked crypto libraries each bundling AES and SHA-256 tables, and (b) inline encrypted configuration blobs. The entry point at 0x1408a9c64 begins with a clean jmp 0x14068c837 into a normal MSVC startup shell. No VM handler noise, no fbld-style filler instructions, no cascading call +0 obfuscation.

Import table

The ntdll.dll row is the most operationally significant one. Direct NtLoadDriver and NtUnloadDriverimports means the loader has the surface to load a kernel driver without going through the Service Control Manager (which would be logged in the Event Log the loader is about to kill anyway).

The static config table at 0x1408eb7b0

Everything the operator wants to configure per build sits in a single tightly packed page at 0x8eb7b0 in .rdata. Every entry is 16-byte-aligned and null-padded to the slot width. This is a compiled-in static const struct config in the original source. Layout below.

FiveM target inventory

Five FiveM DLL names appear plaintext in .rdata, confirming the target game surface.

adhesive.dll is FiveM's anti-cheat component. Its presence in the target list means the loader specifically inspects or hooks it. citizen-scripting-lua.dll is where Lua scripts get evaluated by the FiveM runtime, a natural aimbot or cheat-menu injection surface.

Anti-forensic service kill-list

Five Windows services listed in the config, each of which is the source of truth for a specific piece of the Windows execution audit trail. Every service on this list is where a forensic reviewer would look after the fact:

PCA file-delete list

Three UTF-16LE paths in .rdata immediately before the config table (starting at 0x8eb690). All three are the exact files Windows uses to hold program-launch history, and any forensic sweep run after the fact would grep them for the loader's own image name. If Susano runs to completion before a review starts, these files are gone and no program-launch record survives.

C:\Windows\appcompat\pca\PcaAppLaunchDic.txt
C:\Windows\appcompat\pca\PcaGeneralDb0.txt
C:\Windows\appcompat\pca\PcaGeneralDb1.txt

Process interaction list

Seven target processes in the config table as UTF-16LE strings. All except one are critical Windows system processes. The presence of these names in a config table that also holds SeTcbPrivilege and token-manipulation imports is the fingerprint of a loader that impersonates or injects into system processes.

• services.exe. Service Control Manager
• explorer.exe. Windows Explorer
• smartscreen.exe. Windows SmartScreen
• lsass.exe. Local Security Authority Subsystem
• csrss.exe. Client-Server Runtime Subsystem
• dwm.exe. Desktop Window Manager
• winlogon.exe. Windows Logon (listed after the group of 6)

SeTcbPrivilege escalation

SeTcbPrivilege ("act as part of the operating system") is the highest local privilege on Windows. Combined with the token manipulation imports (OpenProcessToken, DuplicateTokenEx, SetThreadToken, SetTokenInformation, GetTokenInformation), this loader is set up to acquire and impersonate SYSTEM- or TCB-level tokens, which is the standard path to make the subsequent driver-load and service-manipulation operations invisible to the current interactive user's token context.

Kernel driver capability

ntdll.NtLoadDriver and ntdll.NtUnloadDriver are imported directly, bypassing the Service Control Manager which is the SCM path most cheats use. Direct Nt* load skips the services.exe event log entries and the SCM-registered ImagePath resolution flow. Since Susano is presumed not to have a valid code-signing certificate for a kernel driver (the outer PE is not signed at all), this capability strongly implies BYOVD (Bring Your Own Vulnerable Driver) where a signed third-party driver with a known LPE is loaded and abused to run unsigned code in ring 0. The exact driver bundled or downloaded is not present in this outer sample. It would arrive from /v2/download.php on a successful handshake.

SOCKS5 support

Plaintext strings "SOCKS5 sub-negotiation response" and "initial SOCKS5 response" appear in the binary. The client has a full SOCKS5 negotiation surface, probably from a bundled libcurl or a custom impl. Purpose is unclear from static analysis alone. Could be a proxy fallback for reaching the C2 through corporate networks or a peer-relay for a distributed cheat network.

Crypto architecture

The DES 8-byte-block wrapper is worth calling out. It uses a 7-byte input key, expands to 8 bytes with parity nibble-shift (textbook DES key format), builds a PLAINTEXTKEYBLOB in place, calls CryptImportKey with CALG_DES (0x6601) and encrypts exactly 8 bytes. Only used at one call site. Not the main C2 encryption. Likely used to derive an 8-byte token or to seal one field of the handshake.

C2 handshake wire format

The initial handshake POSTs a 176-byte binary body to http://susano.gg/v2/oauth.php. Cloudflare fronts the origin (cf-ray, server: cloudflare, cf-cache-status: DYNAMIC in response headers). The response is 112 bytes of binary served under a mislabelled text/html Content-Type.

Sample request body (hex, 176 bytes):

af56ff55e111107ce29b836b8da3256333dfb7ce5dd8e38c617f29dcf54a4c75af7a753a83ede99599cc135c934289e4391db0a5de41163b09777883e787ae4dda812ce78337ce71c9171c08ed88e85dc49c106a74202a850cc606092d9876644db49c603c02333fe09a369dc25ac7da8b6d96924722554709a79c4f8f7a8181ba6e888aac4565fc726d19a5fbde80c1fd7b4a6a853212c70d2891286204064cb22f9ce73f7c211420f702d5cf5a5c8b

Sample response body (hex, 112 bytes):

f80c7c4c91bcca1d68fb229bac1efdcef2a2602c7b9d67536a8d2dfb20e6908ada5ceb55032a3e74db6f7d79fcde764fb2f25f0f2d12cda80e6fe14efff2e2514692aecd2e479f79b1b9e8d983117408d566847ecd112704f5543567fd30a82e8c6eac584d65843a07f5673a0cadcc24

Replaying the exact same 176-byte request produces a different 112-byte response every time, confirming the server either seeds a per-response nonce or generates fresh session material on each handshake.

af56ff55e111107ce29b836b8da3256333dfb7ce5dd8e38c617f29dcf54a4c75af7a753a83ede99599cc135c934289e4391db0a5de41163b09777883e787ae4dda812ce78337ce71c9171c08ed88e85dc49c106a74202a850cc606092d9876644db49c603c02333fe09a369dc25ac7da8b6d96924722554709a79c4f8f7a8181ba6e888aac4565fc726d19a5fbde80c1fd7b4a6a853212c70d2891286204064c

KEY  = REQ[0:32]     # AES-256 master key, invariant across sessions
IV   = REQ[32:48]    # CBC IV, invariant across sessions
MASK = REQ[48:64]    # XOR unwrap mask, invariant across sessions

def decrypt_response(resp_112b):
    inner = bytes(a ^ MASK[i % 16] for i, a in enumerate(resp_112b))
    return AES.new(KEY, AES.MODE_CBC, IV).decrypt(inner)

Live memory of the running loader also contains the standard AES-256 S-box at 0x1408ec590 and standard AES Rcon at 0x1408ec790. Byte-perfect canonical values in both cases. The key-schedule loop that consumes those tables is byte-verified as AES-256 (Nk=8, with the mod-Nk=4 SubBytes-only branch that is unique to AES-256's schedule). The schedule appears in the runtime-decrypted body of the loader and is not visible in the on-disk .text at rest.

Backend endpoints

Endpoint enumeration against susano.gg:

Susano's backend is minimal. Two endpoints, both POST, both 200-with-empty-body when auth fails so an attacker walking the API cannot easily distinguish "endpoint does not exist" from "endpoint exists but you are unauthenticated". This is deliberate.

Payload architecture (5.6 MB blob from /v2/buffer.php)

After the oauth handshake succeeds and the client walks away with a valid session key, the loader makes a second HTTP request. POST /v2/buffer.php with a 640-byte body of the form t={token16}&h={hwid_hash}&v=ltbf&u={userID}&l=0. The body is URL-form plaintext wrapped by the same AES-256-CBC plus XOR mask cipher the oauth request uses. The origin sends back a 5,648,480-byte binary body. Once that is decrypted with the session key the plaintext resolves to a single 5,701,632-byte memory region holding two Windows PE files back-to-back plus a tail of zero padding.

Offset      Size           Contents
0x000000    2,705,488 B    User-mode Susano cheat DLL
                           (memory-mapped PE image, MZ header zeroed,
                            .text starts around 0x1000 relative)
0x294850    2,941,952 B    Windows kernel driver .sys
                           (standard PE32+, valid MZ+PE header,
                            Subsystem=Native, x86-64, 7 sections)
0x554fb0       54,192 B    Zero padding (only 199 non-zero bytes,
                           tail of AES-CBC output before PKCS7 trim)

User-mode Susano DLL

RTTI type descriptors present in the DLL (standard MSVC compiler output confirming C++ exception path with std:: types):

• .?AVinvalid_argument@std@@
• .?AVlength_error@std@@
• .?AVlogic_error@std@@
• .?AVregex_error@std@@
• .?AVruntime_error@std@@
• .?AVout_of_range@std@@
• .?AVbad_alloc@std@@
• .?AVbad_array_new_length@std@@
• .?AVbad_exception@std@@
• .?AVexception@std@@
• .?AVfacet@locale@std@@
• .?AV_Facet_base@std@@
• .?AV_Locimp@locale@std@@
• .?AV?$collate@D@std@@
• .?AV?$ctype@D@std@@
• .?AUctype_base@std@@
• .?AU_Crt_new_delete@std@@
• .?AVtype_info@@

Kernel driver .sys (the real product)

This is the file Susano actually sells. Everything else in the pipeline exists to get it into ring-0 without an EDR catching the delivery. Subsystem is Native (0x1), Machine is x86-64 and it pulls 52 kernel APIs from ntoskrnl.exe covering the entire BYOVD process-injection surface.

Complete import list from ntoskrnl.exe (52 APIs):

Capability inferred per-API cluster:

Complete feature inventory (76 config keys, 10 categories)

Every config key sitting in the user-mode DLL's .rdata string table. These are the exact toggle names the menu exposes to the paying user, grouped here by feature category. Every one of them is a live config key on Susano's shipping build.

Anticheat identifier table (17 named + UNKNOWN)

Susano's user-mode DLL carries an identifier table of 18 slots at file offset 0x63750. Slot 0 is the UNKNOWN fallback and slots 1 through 17 are FiveM anticheat names, adjacent in memory and padded to 8-byte or 16-byte boundaries. The identifier runs at cheat startup, scans the target FiveM server's loaded resources and script names, and writes back the matching slot index. A single cmp ecx, 17 bounds check at 0x43ebe gates the write.

User-mode hook technique

Susano does not do inline patching of the GTA5.exe or adhesive.dll code pages. The user-mode DLL's IAT and the kernel driver's signature-scan engine together spell out a very deliberate hooking strategy that leaves the targeted code bytes untouched.

FiveM in-process module targets

Loader offset 0x8ec060 carries a contiguous UTF-16 list of FiveM in-process DLL names. Immediately before it lie ntdll.dll and API-name strings GetModuleHandleA and NtQuerySystemInformation. That is the resolver stub the loader uses to walk the loaded-module list and match each name.

GTA V engine data embedded in the user-mode DLL

The user-mode DLL carries a substantial static database of GTA V engine data. Bone-tag tables that drive the aimbot's target selection, weapon and weapon-component name tables that power the ESP labels and give-all-attach features, plus aim-cone and prediction floating-point constants, plus a very large table of GTA5.exe RVAs.

Build GUIDs

Two 16-byte GUIDs live inside the Susano binaries as raw byte constants (not documented Microsoft interface or CLSID values). Both are candidate build fingerprints or product namespace UUIDs.

Crypto constants and hash tables

Beyond the AES SBox / InvSBox / RCON block, the loader carries a second, independent hash surface: full SHA-256 round constants, three copies of the SHA-256 initial IV and an encrypt-and-hash-only Windows CryptoAPI import stack that does NOT include CryptDecrypt.

Anti-analysis probe (XOR-hidden)

The loader carries exactly one XOR-obfuscated string in its whole 10.3 MB image. That string is a registry key path used specifically to check for the presence of a reverse-engineering tool.

Loader network stack (beyond plain HTTPS)

The Susano loader ships a much larger client-side network toolkit than a simple HTTPS beacon needs. Everything in the table below is byte-verified against the loader's .rdata and IAT.

Persistence and driver install path

How the loader stores its own state and installs the kernel driver. Every string in the table below is byte-verified in the loader binary.

Driver targets (FiveM / GTA5 surface)

Every FiveM-specific string embedded in the kernel driver, extracted verbatim from its UTF-16 string table. The driver walks target processes with kernel-mode wildcards (FsRtlIsNameInExpression) and reads or writes the FiveM asset files below directly from ring 0.

Driver internals (kernel data structures)

The driver names five kernel data-structure or function primitives in its own string table beyond its 52-API import list. Each name gives away one specific ring-0 capability the driver reaches for at runtime rather than statically imports.

Driver anti-forensic surface

The loader's anti-forensic story is only half the picture. The kernel driver ships its own, larger cleanup path that runs from ring 0 and touches sources the user-mode loader cannot reach without a filter-driver conflict. Every entry in the table below is a verbatim string in the driver's UTF-16 table.

Driver IOCTL surface

Seven distinct IOCTL codes appear as 32-bit constants in the driver's .text and .rdata sections, all in the FILE_DEVICE_UNKNOWN (0x22) device family. This is the user-mode-to-kernel-mode command surface the DLL uses to issue reads, writes, process attaches and cleanup requests. Function codes reconstructed from the raw CTL_CODE encoding.

IOCs

Detection kit (v1 + v2)

Two tiered detection kits for AC operators. Every rule is anchored on multi-signal AND-chains keyed on byte-perfect Susano-branded literals so no legitimate software, Microsoft component, OEM installer, EDR agent, anti-cheat driver or unrelated malware family can trigger them. Both kits run entirely server-side inside Clubhouse AC. The v1 and v2 scanner binaries ship with no indicator data and no rule content, so anyone reverse-engineering the client cannot enumerate what is being matched. The scanner uploads raw evidence to the Clubhouse AC evidence pipeline; the server performs all rule evaluation and returns only the matched detection IDs used to drive follow-up scans and the user report.

Primary YARA rule (v1 broad), keyed on the co-occurrence of the Susano-branded User-Agent, both v2 endpoints and one of three strong anchors:

import "pe"

rule Susano_Loader_Family_v1_Broad
{
    meta:
        family      = "Susano"
        component   = "loader"
        variant     = "v1_broad"
        description = "Susano loader dropper family (Setup.exe / Setup1.exe / Setupuptodate.exe / Setup_1.exe). Requires three orthogonal signals: (a) Susano User-Agent, (b) both v2 endpoints, (c) either the masqueraded persistence key or the XOR-obfuscated IDA anti-analysis blob."
        imphash     = "89279bc839f47ce69afbd562c3637253"
    strings:
        $ua        = "SusanoUA/1.0" ascii fullword
        $ep_oauth  = "/v2/oauth.php"  ascii
        $ep_buffer = "/v2/buffer.php" ascii
        $reg       = "Software\\Microsoft\\Windows\\CurrentVersion\\DevicePath\\Configuration" ascii
        $reg_val   = "AdapterConfig" ascii fullword
        // 31-byte 0xD1-XORed IDA history path constant at loader offset 0xc4de5
        $xor_ida   = { 82 BE B7 A5 A6 B0 A3 B4 8D 99 B4 A9 FC 83 B0 A8 82 8D 98 95 90 8D 99 B8 82 A5 BE A3 A8 E7 E5 }
        $proto_v1  = "&v=lt18&htf=" ascii
        $proto_v2  = "&v=ltbf&u="   ascii
    condition:
        uint16(0) == 0x5A4D and pe.is_pe and
        pe.machine == pe.MACHINE_AMD64 and
        pe.subsystem == pe.SUBSYSTEM_WINDOWS_GUI and
        filesize > 9MB and filesize < 12MB and
        $ua and all of ($ep_*) and
        (($reg and $reg_val) or $xor_ida or all of ($proto_*))
}

Primary Suricata rule (network anchor, zero-FP by itself because the UA is a Susano branded literal):

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"MALWARE Susano phone-C2 relay - SusanoUA/1.0 POST to susano host";
  flow:established,to_server;
  http.method; content:"POST";
  http.user_agent; content:"SusanoUA/1.0"; depth:12; isdataat:!1,relative;
  http.host; pcre:"/^(susano\.gg|susano\.re|vps93241\.serveur-vps\.net)$/i";
  http.uri; pcre:"/^\/v2\/(oauth|buffer|download)\.php$/";
  http.content_type; content:"application/x-www-form-urlencoded";
  classtype:trojan-activity;
  metadata:family susano, protocol http, phase c2;
  sid:9210001; rev:1;
)

Primary v2 kernel driver YARA (locks to the .\\;d section name, all three FiveM wildcards, 4-of-7 Susano IOCTLs and the driver build GUID):

import "pe"

rule Susano_Kernel_Driver_v2_Forensic
{
    meta:
        family      = "Susano"
        component   = "kernel-driver"
        variant     = "v2_forensic"
        sha256      = "0aeba1809df1792d36861b70120c2ec5d79aeb978c1c11eb71610b9752557bfb"
    strings:
        // Section header ".\;d\x00", five raw bytes. No legitimate MSVC/LLD/GNU ld toolchain
        // emits a section identifier containing backslash or semicolon.
        $sec_name   = { 2E 5C 3B 64 00 }
        $wild1      = "*\\GTA5.EXE"            wide
        $wild2      = "*\\FIVEM*PROCESS.EXE"   wide
        $wild3      = "*\\FIVEM*CHROMEBROWSER" wide
        $guid_drv   = { 3A A7 DE 54 1F ED A4 42 AF 71 3E 63 D0 56 F1 74 }
        // 7 Susano IOCTL codes as 32-bit little-endian constants in .rdata
        $ioctl1     = { 08 00 22 22 }
        $ioctl2     = { 00 02 22 22 }
        $ioctl3     = { 00 06 22 22 }
        $ioctl4     = { B4 0C 22 22 }
        $ioctl5     = { BA 0D 22 22 }
        $ioctl6     = { 00 15 22 22 }
        $ioctl7     = { 00 22 22 22 }
        // Any 3 of the anti-forensic wide-string references
        $af_pf      = "\\??\\C:\\Windows\\Prefetch" wide
        $af_bam     = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\bam" wide
        $af_appcompat = "Compatibility Assistant\\Store" wide
        $af_mru     = "OpenSavePidlMRU" wide
        $af_pca1    = "PcaAppLaunchDic.txt" wide
        $af_pca2    = "PcaGeneralDb0.txt"   wide
    condition:
        uint16(0) == 0x5A4D and pe.is_pe and
        pe.machine == pe.MACHINE_AMD64 and
        pe.subsystem == pe.SUBSYSTEM_NATIVE and
        filesize > 1MB and filesize < 10MB and
        $sec_name and all of ($wild*) and $guid_drv and
        4 of ($ioctl*) and
        3 of ($af_*)
}

Primary v2 user-mode DLL rule (anchors on the 17-slot AC identifier table adjacency, the susano! symbolicator literal and the config-key cluster). Twenty additional rules across Sigma / KQL / Zeek / Volatility / kernel-mode C are wired into the scanner. Full FP argument enumerating the 15+ baselines checked lives with the scanner source.

rule Susano_UserMode_DLL_v2_Forensic
{
    meta:
        family    = "Susano"
        component = "user-mode-dll"
        variant   = "v2_forensic"
        sha256    = "cd88aa1dd8b4f59c5dfaaf47d0622de698d7b507cc182d34a8cd2282129d815c"
    strings:
        // Adjacent AC identifier table (must have all four last names together)
        $ac_nb     = "Nb Anticheat"     ascii fullword
        $ac_reason = "Reason Anticheat" ascii fullword
        $ac_cyber  = "Cyber Anticheat"  ascii fullword
        $ac_putin  = "Putin Anticheat"  ascii fullword
        // Crash symbolicator format string (unique to Susano)
        $sym       = "Function: susano!sub_0x%X+0x%llX" ascii
        // Susano config-key cluster (at least 5 of the unique 76)
        $c1 = "silent.magic"      ascii
        $c2 = "silent.avoidrepeat" ascii
        $c3 = "silent.highdmg"    ascii
        $c4 = "aimbot.vsmooth"    ascii
        $c5 = "vesp.tracers"      ascii
        $c6 = "misc.streamproof"  ascii
        $c7 = "act.tpwp"          ascii
        $c8 = "veh.bptires"       ascii
        // 0xDEAD sentinel word in the 16-entry aim-bone table
        $bone_dead = { D9 FC ?? ?? ?? ?? ?? ?? AD DE }
    condition:
        filesize > 1MB and filesize < 10MB and
        all of ($ac_*) and
        $sym and
        5 of ($c*) and
        $bone_dead
}

Generic detections (BYOVD-cheat family shape, not Susano-specific). These catch the Susano pattern and other BYOVD game-cheat families that follow the same architecture (unsigned kernel driver dropped from %TEMP%, native NtLoadDriver install, audit-service kill, phone-C2 long poll). Each is built on multi-signal AND-chains so no legitimate program can trigger.

# GEN-001 : Unsigned kernel driver dropped from %TEMP% loaded via native NtLoadDriver
driver.ImagePath  matches  /\?\?\C:\Users\.*\AppData\Local\Temp\.*\.(tmp|sys)$/i
  AND driver.signature  IN  (invalid, absent)
  AND driver.load_path  == "NtLoadDriver"  (not SCM CreateService)
  -> generic BYOVD stager fingerprint
# Legit drivers install via SCM under %WinDir%\System32\drivers with WHQL sig.
# Anti-cheats (Vanguard, EAC, BattlEye, Ricochet, VAC) all meet this. Zero legit hit.

# GEN-002 : PE section name contains backslash or semicolon (illegal COFF identifier)
pe.sections[*].name  matches  /[\\;]/
  AND (section.flags & IMAGE_SCN_MEM_EXECUTE OR section.raw_size > 100KB)
  -> author-flag fingerprint
# MSVC / LLD / GNU ld / MASM / Delphi all reject these characters. Only manually-authored
# PEs bypassing the validator emit them. Catches Susano's ".\;d" plus any similar tell.

# GEN-003 : Audit-service kill burst
COUNT( services IN {EventLog, DiagTrack, PcaSvc, DPS, Dnscache} transitioned to Stopped ) >= 3
  WITHIN 60s
  AND initiator NOT IN {services.exe, wininit.exe, TrustedInstaller.exe}
  AND system.mode NOT IN {shutdown, setup, sysprep}
  -> generic anti-forensic wipe pattern
# Legit patch workflows do not batch-stop these services. Excludes system boot/shutdown paths.

# GEN-004 : BAM record silently removed for a recently-executed image
process X has Prefetch entry newer than 24h
  AND no BAM UserSettings entry for X across any user SID
  AND system.uptime > 24h
  AND no sysprep event in last 7d
  -> ring-0 anti-forensic wipe (generic)
# BAM records every foreground launch. Only ring-0 code can silently remove entries.

# GEN-005 : Kernel driver dropped as .tmp under %TEMP%
file under %USERPROFILE%\AppData\Local\Temp
  AND filename matches /^[a-zA-Z0-9]{1,16}\.[a-zA-Z0-9]{1,16}\.tmp$/
  AND content starts with MZ
  AND pe.subsystem == IMAGE_SUBSYSTEM_NATIVE (0x1)
  AND filesize < 15MB
  -> generic BYOVD stager
# Native subsystem is only used by kernel drivers. Dropping one as .tmp is extraordinary.

# GEN-006 : Custom vendor-branded HTTP User-Agent not in legitimate allowlist
http.user_agent  matches  /^([A-Z][a-zA-Z0-9]{3,20})UA\/\d+\.\d+$/
  AND capture_group_1  NOT IN  {Mozilla, Chrome, Edg, Firefox, Safari, Opera, Vivaldi,
                                 Brave, Discord, Slack, Teams, Zoom, curl, wget,
                                 PowerShell, Windows-Update, MSIE, PostmanRuntime,
                                 python-requests, Go-http-client, okhttp, Java, node-fetch,
                                 kubectl, azure-cli, aws-cli, gcloud, npm, docker-compose,
                                 GitHubActions, dropbox, spotify, steamvr, notion, obsidian,
                                 epicgameslauncher, RockstarGamesLauncher, RiotClient,
                                 Valorant, League, cf}
  -> generic cheat/malware C2 fingerprint
# Catches SusanoUA/1.0 and any similar unhyphenated vendor-branded UA outside a small allowlist.

# GEN-007 : Correlation. GEN-001 + GEN-003 within 60s
GEN-001 fires  AND  GEN-003 fires  WITHIN 60s on same host
  -> confirmed BYOVD anti-forensic sequence

# GEN-008 : Unsigned process opens GTA5.exe with R/W memory access
sysmon.event == 10 (ProcessAccess)
  AND target.image == GTA5.exe
  AND granted_access & (PROCESS_VM_READ | PROCESS_VM_WRITE) != 0
  AND source.signature IN (invalid, absent, self-signed)
  AND source.image NOT IN {GTA5.exe, FiveM*.exe, RockstarGames-signed helpers, Microsoft-signed}
  -> generic external cheat pattern

# GEN-009 : Driver imports the full BYOVD ring-0 memory-manipulation surface
driver imports 5+ of {KeAttachProcess, KeStackAttachProcess, MmCopyVirtualMemory,
                       ZwProtectVirtualMemory, PsLookupProcessByProcessId, ZwSetSystemInformation,
                       ObReferenceObjectByHandle, MmMapIoSpace, MmGetPhysicalAddress,
                       PsGetProcessSectionBaseAddress}
  AND driver.signature IN (invalid, absent, self-signed)
  -> generic game-cheat kernel component

# GEN-010 : Random-named device object from an unsigned %TEMP% driver
loaded driver creates \Device\<name>  where name matches /^[a-zA-Z0-9]{6,16}$/
  AND driver.signature IN (invalid, absent)
  AND driver.ImagePath contains \Temp\
  -> generic BYOVD stealth pattern

# GEN-011 : 10s HTTP long-poll with fixed body size and reused 64-byte prefix
3+ HTTP POST requests to same host within 60s
  AND intervals ~10s (+-2s)
  AND request.body.length IN {176, 640}
  AND first 64 bytes of request body byte-identical across all requests
  -> phone-controlled C2 relay (generic)
# Legit long-poll clients (Discord, Slack) rotate auth tokens so their body prefixes vary.

# GEN-012 : PE with cheat-family imphash + attacker-shape file size + missing signature
pe.imphash IN {known-cheat imphash list}
  AND filesize BETWEEN 8MB AND 12MB
  AND (unsigned OR signature invalid)
  -> upgraded imphash hit

# GEN-013 : Prefetch wiped on healthy long-running system
count(*.pf in C:\Windows\Prefetch) == 0
  AND system.uptime > 7d
  AND SysMain service is enabled
  -> generic anti-forensic sweep

# GEN-014 : Content-Type lie
http.content_type == application/x-www-form-urlencoded
  AND request.body.size >= 128
  AND shannon_entropy(body) >= 7.5
  AND body contains 0 occurrences of '=' or '&'
  -> obfuscated cheat/malware wire format (generic)

# GEN-015 : Chain. GEN-001 + GEN-006 + GEN-003 within 5 minutes
GEN-001 fires  AND  GEN-006 fires  AND  GEN-003 fires
  WITHIN 5 minutes on same host
  -> confirmed BYOVD game-cheat install sequence

YARA rule

Keyed off the compiled-in config table entries which cannot easily change without a source rebuild.

import "pe"

// -------------------------------------------------------------------------
// Rule 1: Susano loader (any of the 4 observed builds)
// -------------------------------------------------------------------------
rule Susano_Setup_FiveM_Cheat_Loader
{
    meta:
        description = "Susano FiveM cheat loader / installer. Matches any of the observed loader builds via the config-table markers and FiveM DLL target list."
        author      = "Clubhouse AC Research"
        family      = "Susano.gg loader / installer"
        reference   = "https://clubhouseac.shop/research/susano-setup-exe"
        sample_sha256_setup      = "65922561c8304fadf5d01c50ca7375f9b2b8afbd2aebac4202657b930d214558"
        sample_sha256_setup_1    = "4c43f0b310b960623002a60d53f5462fc8595b95c0004adae3118f5edfecea8f"

    strings:
        // The 3-host adjacent config block is the strongest marker. Any future 
        // build that keeps the same operator will reuse these hostnames or their
        // successors in this layout.
        $host1 = "susano.gg" ascii
        $host2 = "susano.re" ascii
        $vps   = "serveur-vps.net" ascii

        // Both endpoint paths (buffer.php replaced download.php in the newer builds)
        $ep1 = "/v2/oauth.php"    ascii
        $ep2 = "/v2/buffer.php"   ascii
        $ep3 = "/v2/download.php" ascii

        // Full service-kill list adjacent in .rdata
        $svc1 = "PcaSvc"    ascii
        $svc2 = "DPS"       ascii
        $svc3 = "DiagTrack" ascii
        $svc4 = "Dnscache"  ascii
        $svc5 = "EventLog"  ascii

        // Anti-forensic PCA delete-list (UTF-16LE fragments)
        $pca1 = "PcaAppLaunchDic.txt" wide
        $pca2 = "PcaGeneralDb"        wide

        // The privileged operations
        $priv1 = "SeTcbPrivilege" wide
        $priv2 = "NtLoadDriver"   ascii
        $priv3 = "NtUnloadDriver" ascii

        // FiveM-specific target inventory
        $fm1 = "citizen-scripting-lua.dll" ascii
        $fm2 = "gta-net-five.dll"          ascii
        $fm3 = "adhesive.dll"              ascii

        // Product user-agent constructor fragment
        $ua = "SusanoUA/1.0" ascii

    condition:
        uint16(0) == 0x5A4D and
        pe.is_pe and
        pe.machine == pe.MACHINE_AMD64 and
        filesize > 5MB and filesize < 50MB and
        // Any 2 of the 3 hosts (in case one is dropped) plus at least 3 kill-services
        // plus at least 2 privileged-operation strings plus at least 2 FiveM targets
        2 of ($host1, $host2, $vps) and
        3 of ($svc1, $svc2, $svc3, $svc4, $svc5) and
        2 of ($priv1, $priv2, $priv3) and
        2 of ($fm1, $fm2, $fm3) and
        any of ($ep1, $ep2, $ep3, $ua)
}

// -------------------------------------------------------------------------
// Rule 2: Susano user-mode cheat DLL (from /v2/buffer.php)
// -------------------------------------------------------------------------
rule Susano_UserMode_Cheat_DLL
{
    meta:
        description = "Susano FiveM cheat user-mode DLL. The first 2.58 MB of the /v2/buffer.php payload after decryption. Matches on the compiled-in config-key strings and the AC-bypass menu labels."
        author      = "Clubhouse AC Research"
        family      = "Susano.gg user-mode cheat DLL"
        reference   = "https://clubhouseac.shop/research/susano-setup-exe"
        sample_sha256 = "cd88aa1dd8b4f59c5dfaaf47d0622de698d7b507cc182d34a8cd2282129d815c"

    strings:
        // Susano-specific silent-aim config keys (unique cluster)
        $silent1 = "silent.magic"      ascii
        $silent2 = "silent.avoidrepeat" ascii
        $silent3 = "silent.highdmg"    ascii
        $silent4 = "silent.enabled"    ascii

        // ESP config keys
        $esp1 = "esp.skeleton" ascii
        $esp2 = "esp.tracers"  ascii
        $esp3 = "esp.outlines" ascii
        $esp4 = "vesp.tracers" ascii

        // Player mod config keys
        $player1 = "player.antiaim"    ascii
        $player2 = "player.antihs"     ascii
        $player3 = "player.expmelee"   ascii
        $player4 = "player.godmode"    ascii

        // Named AC bypass menu labels (all four together is Susano-specific)
        $ac1 = "Cyber Anticheat"  ascii
        $ac2 = "Nb Anticheat"     ascii
        $ac3 = "Putin Anticheat"  ascii
        $ac4 = "Reason Anticheat" ascii

        // Crash symbolicator format string (unique to Susano)
        $sym1 = "susano!sub_0x" ascii
        $sym2 = "Function: susano!sub_0x%X+0x%llX" ascii

        // FiveM server info regex patterns (compiled in)
        $rx1 = "\"hostname\"\\s*:\\s*\"([^\"]*)\"" ascii
        $rx2 = "\"sv_maxclients\"\\s*:\\s*(\\d+)" ascii

        // Menu labels
        $menu1 = "Susano Lite" ascii
        $menu2 = "Silent Aim"  ascii
        $menu3 = "Sticky Aim"  ascii

    condition:
        filesize > 1MB and filesize < 10MB and
        // At least 3 silent-aim keys AND all 4 AC labels together is a hard match
        3 of ($silent*) and
        3 of ($esp*) and
        3 of ($player*) and
        all of ($ac1, $ac2, $ac3, $ac4) and
        any of ($sym1, $sym2) and
        any of ($rx1, $rx2, $menu1, $menu2, $menu3)
}

// -------------------------------------------------------------------------
// Rule 3: Susano kernel driver (from /v2/buffer.php, delivered inside payload)
// -------------------------------------------------------------------------
rule Susano_Kernel_Driver
{
    meta:
        description = "Susano FiveM cheat kernel driver. Delivered inside the /v2/buffer.php payload at offset 0x294850 relative to the decrypted region. Native subsystem, x86-64, imports 52 ntoskrnl APIs including the full BYOVD process-injection surface, plus FiveM-specific target strings and Windows anti-forensic paths."
        author      = "Clubhouse AC Research"
        family      = "Susano.gg kernel driver"
        reference   = "https://clubhouseac.shop/research/susano-setup-exe"
        sample_sha256 = "0aeba1809df1792d36861b70120c2ec5d79aeb978c1c11eb71610b9752557bfb"

    strings:
        // Kernel APIs stored as null-terminated ASCII in the import section
        $api1  = "PsLookupProcessByProcessId" ascii
        $api2  = "KeAttachProcess"            ascii
        $api3  = "KeDetachProcess"            ascii
        $api4  = "MmCopyVirtualMemory"        ascii
        $api5  = "ZwProtectVirtualMemory"     ascii
        $api6  = "ZwSetSystemInformation"     ascii
        $api7  = "ZwEnumerateKey"             ascii
        $api8  = "ZwDeleteValueKey"           ascii
        $api9  = "NtSetEaFile"                ascii
        $api10 = "NtQueryEaFile"              ascii
        $api11 = "SeLocateProcessImageName"   ascii
        $api12 = "MmGetSystemRoutineAddress"  ascii
        $api13 = "FsRtlIsNameInExpression"    ascii

        // ntoskrnl.exe import DLL name
        $krnl = "ntoskrnl.exe" ascii

        // Distinct '.;d' section name (unusual, appears in the payload driver's PE section table)
        $secname = ".\;d\x00" ascii

        // FiveM / GTA5 wildcards (UTF-16LE, unique combo)
        $fivem1 = "*\GTA5.EXE"             wide
        $fivem2 = "*\FIVEM*PROCESS.EXE"    wide
        $fivem3 = "*\FIVEM*CHROMEBROWSER"  wide

        // FiveM asset files (UTF-16LE)
        $asset1 = "manifest.fingerprint" wide
        $asset2 = "game_files.dat"       wide
        $asset3 = "fivem_set.bin"        wide
        $asset4 = "font_lib_cfx.gfx"     wide
        $asset5 = "launcher_skip_mtl2"   wide

        // Anti-forensic registry / file paths (UTF-16LE)
        $af1 = "\??\C:\Windows\Prefetch"  wide
        $af2 = "\State\UserSettings"        wide  // BAM
        $af3 = "AppCompatFlags\Compatibility Assistant\Store" wide
        $af4 = "OpenSavePidlMRU"              wide

        // Kernel data structure targets (UTF-16LE)
        $ktarget1 = "KeCapturePersistentThreadState"     wide
        $ktarget2 = "HalPrivateDispatchTable"            wide
        $ktarget3 = "Circular Kernel Context Logger"     wide

    condition:
        uint16(0) == 0x5A4D and
        pe.is_pe and
        pe.machine == pe.MACHINE_AMD64 and
        pe.subsystem == pe.SUBSYSTEM_NATIVE and
        filesize > 1MB and filesize < 10MB and
        $krnl and
        // All BYOVD-critical kernel APIs present
        all of ($api1, $api2, $api3, $api4, $api5, $api6) and
        // At least 2 of the anti-forensic / EA-hiding APIs
        2 of ($api7, $api8, $api9, $api10) and
        // Any 1 of the FiveM/GTA5 wildcards + any 1 asset + any 1 anti-forensic path
        // makes this Susano-specific, not any random BYOVD driver
        1 of ($fivem*) and
        1 of ($asset*) and
        1 of ($af*)
}

Closing