Susano Setup.exe

Summary

Sample identity

No protector on the outer shell

Nothing here matches the shape of a commercial protector. Sections have real names (.text / .rdata / .data / .pdata / .rsrc / .reloc / .fptable), .pdata holds real SEH unwind info, .reloc is populated, imports are a full-fat 150+ from KERNEL32 with real per-DLL function counts (not the one-stub-per-DLL pattern VMProtect uses). MSVC linker fingerprint matches Visual Studio 2022 (14.44). Entropy in .text is 7.3 which is high but explained by (a) three separate statically linked crypto libraries each bundling AES and SHA-256 tables, and (b) inline encrypted configuration blobs. The entry point at 0x1408a9c64 begins with a clean jmp 0x14068c837 into a normal MSVC startup shell. No VM handler noise, no fbld-style filler instructions, no cascading call +0 obfuscation.

Import table

The ntdll.dll row is the most operationally significant one. Direct NtLoadDriver and NtUnloadDriverimports means the loader has the surface to load a kernel driver without going through the Service Control Manager (which would be logged in the Event Log the loader is about to kill anyway).

The static config table at 0x1408eb7b0

Everything the operator wants to configure per build sits in a single tightly packed page at 0x8eb7b0 in .rdata. Every entry is 16-byte-aligned and null-padded to the slot width. This is a compiled-in static const struct config in the original source. Layout below.

FiveM target inventory

Five FiveM DLL names appear plaintext in .rdata, confirming the target game surface.

adhesive.dll is FiveM's anti-cheat component. Its presence in the target list means the loader specifically inspects or hooks it. citizen-scripting-lua.dll is where Lua scripts get evaluated by the FiveM runtime, a natural aimbot or cheat-menu injection surface.

Anti-forensic service kill-list

Five Windows services listed in the config, each of which is the source of truth for a specific piece of the Windows execution audit trail. Every service on this list is where a screenshare tool would look after the fact:

PCA file-delete list

Three UTF-16LE paths in .rdata immediately before the config table (starting at 0x8eb690). All three are the exact files the detect.ac / detectfm.exe screenshare tool reads via its own File-source finding type. If Susano runs to completion before a screenshare, these are gone and detect.ac cannot pull program-launch history from them.

C:\Windows\appcompat\pca\PcaAppLaunchDic.txt
C:\Windows\appcompat\pca\PcaGeneralDb0.txt
C:\Windows\appcompat\pca\PcaGeneralDb1.txt

Process interaction list

Seven target processes in the config table as UTF-16LE strings. All except one are critical Windows system processes. The presence of these names in a config table that also holds SeTcbPrivilege and token-manipulation imports is the fingerprint of a loader that impersonates or injects into system processes.

• services.exe. Service Control Manager
• explorer.exe. Windows Explorer
• smartscreen.exe. Windows SmartScreen
• lsass.exe. Local Security Authority Subsystem
• csrss.exe. Client-Server Runtime Subsystem
• dwm.exe. Desktop Window Manager
• winlogon.exe. Windows Logon (listed after the group of 6)

SeTcbPrivilege escalation

SeTcbPrivilege ("act as part of the operating system") is the highest local privilege on Windows. Combined with the token manipulation imports (OpenProcessToken, DuplicateTokenEx, SetThreadToken, SetTokenInformation, GetTokenInformation), this loader is set up to acquire and impersonate SYSTEM- or TCB-level tokens, which is the standard path to make the subsequent driver-load and service-manipulation operations invisible to the current interactive user's token context.

Kernel driver capability

ntdll.NtLoadDriver and ntdll.NtUnloadDriver are imported directly, bypassing the Service Control Manager which is the SCM path most cheats use. Direct Nt* load skips the services.exe event log entries and the SCM-registered ImagePath resolution flow. Since Susano is presumed not to have a valid code-signing certificate for a kernel driver (the outer PE is not signed at all), this capability strongly implies BYOVD (Bring Your Own Vulnerable Driver) where a signed third-party driver with a known LPE is loaded and abused to run unsigned code in ring 0. The exact driver bundled or downloaded is not present in this outer sample. It would arrive from /v2/download.php on a successful handshake.

SOCKS5 support

Plaintext strings "SOCKS5 sub-negotiation response" and "initial SOCKS5 response" appear in the binary. The client has a full SOCKS5 negotiation surface, probably from a bundled libcurl or a custom impl. Purpose is unclear from static analysis alone. Could be a proxy fallback for reaching the C2 through corporate networks or a peer-relay for a distributed cheat network.

Crypto architecture

The DES 8-byte-block wrapper is worth calling out. It uses a 7-byte input key, expands to 8 bytes with parity nibble-shift (textbook DES key format), builds a PLAINTEXTKEYBLOB in place, calls CryptImportKey with CALG_DES (0x6601) and encrypts exactly 8 bytes. Only used at one call site. Not the main C2 encryption. Likely used to derive an 8-byte token or to seal one field of the handshake.

C2 handshake wire format

The initial handshake POSTs a 176-byte binary body to http://susano.gg/v2/oauth.php. Cloudflare fronts the origin (cf-ray, server: cloudflare, cf-cache-status: DYNAMIC in response headers). The response is 112 bytes of binary served under a mislabelled text/html Content-Type.

Sample request body (hex, 176 bytes):

af56ff55e111107ce29b836b8da3256333dfb7ce5dd8e38c617f29dcf54a4c75af7a753a83ede99599cc135c934289e4391db0a5de41163b09777883e787ae4dda812ce78337ce71c9171c08ed88e85dc49c106a74202a850cc606092d9876644db49c603c02333fe09a369dc25ac7da8b6d96924722554709a79c4f8f7a8181ba6e888aac4565fc726d19a5fbde80c1fd7b4a6a853212c70d2891286204064cb22f9ce73f7c211420f702d5cf5a5c8b

Sample response body (hex, 112 bytes):

f80c7c4c91bcca1d68fb229bac1efdcef2a2602c7b9d67536a8d2dfb20e6908ada5ceb55032a3e74db6f7d79fcde764fb2f25f0f2d12cda80e6fe14efff2e2514692aecd2e479f79b1b9e8d983117408d566847ecd112704f5543567fd30a82e8c6eac584d65843a07f5673a0cadcc24

Replaying the exact same 176-byte request produces a different 112-byte response every time, confirming the server either seeds a per-response nonce or generates fresh session material on each handshake. The body is encrypted with a non-CryptoAPI custom construction keyed off session-scoped CryptGenRandom material passed through the SHA-256 KDF wrapper at 0x1408a8290. Recovering plaintext requires the per-session key material, which the client never emits.

Backend endpoints

Endpoint enumeration against susano.gg:

Susano's backend is minimal. Two endpoints, both POST, both 200-with-empty-body when auth fails so an attacker walking the API cannot easily distinguish "endpoint does not exist" from "endpoint exists but you are unauthenticated". This is deliberate.

IOCs

YARA rule

Keyed off the compiled-in config table entries which cannot easily change without a source rebuild.

import "pe"

rule Susano_Setup_FiveM_Cheat_Config_Table
{
    meta:
        description = "Susano FiveM cheat installer (Setup.exe). Identifies via the adjacent domain strings in .rdata and the FiveM DLL target list"
        author      = "Clubhouse AC Research"
        family      = "Susano.gg loader / installer"
        reference   = "https://clubhouseac.shop/research/susano-setup-exe"
        sample_sha256 = "65922561c8304fadf5d01c50ca7375f9b2b8afbd2aebac4202657b930d214558"

    strings:
        // The 3-host adjacent config block is the strongest marker. Any future Susano
        // build that keeps the same operator will reuse these hostnames or their
        // successors in this layout.
        $host1 = "susano.gg" ascii
        $host2 = "susano.re" ascii
        $vps   = "serveur-vps.net" ascii

        // Full service-kill list adjacent in .rdata
        $svc1 = "PcaSvc"    ascii
        $svc2 = "DPS"       ascii
        $svc3 = "DiagTrack" ascii
        $svc4 = "Dnscache"  ascii
        $svc5 = "EventLog"  ascii

        // Anti-forensic PCA delete-list (UTF-16LE fragments)
        $pca1 = "PcaAppLaunchDic.txt" wide
        $pca2 = "PcaGeneralDb"        wide

        // The privileged operations
        $priv1 = "SeTcbPrivilege" wide
        $priv2 = "NtLoadDriver"   ascii
        $priv3 = "NtUnloadDriver" ascii

        // FiveM-specific target inventory
        $fm1 = "citizen-scripting-lua.dll" ascii
        $fm2 = "gta-net-five.dll"          ascii
        $fm3 = "adhesive.dll"              ascii

    condition:
        uint16(0) == 0x5A4D and
        pe.is_pe and
        pe.machine == pe.MACHINE_AMD64 and
        filesize > 5MB and filesize < 50MB and
        // Any 2 of the 3 hosts (in case one is dropped) plus at least 3 kill-services
        // plus at least 2 privileged-operation strings plus at least 2 FiveM targets
        2 of ($host1, $host2, $vps) and
        3 of ($svc1, $svc2, $svc3, $svc4, $svc5) and
        2 of ($priv1, $priv2, $priv3) and
        2 of ($fm1, $fm2, $fm3)
}

Closing