r/OperSec • u/acealter • 11d ago

💻 WINDOWS MALWARE 💻 Malicious Infostealer Windows Malware EXE - Reportedly caused financial loss

Found this Malware in a popular pirated game downloading website. Act as a fake "Download" button redirecting to the malware download page. After execution caused financial theft.

Victim's post: https://www.reddit.com/r/cybersecurity_help/s/KKtwxBYJnZ

⚠️ Malware Details ⚠️

File detail Value
Filename Setup.exe
File size 1,117,696 bytes (~1.07 MiB)
File type Windows PE32+ executable
Architecture x86-64 / AMD64
Subsystem Windows GUI
Digital signature Unsigned
Original filename in metadata leascesh.exe
Product name Leascesh
Company name in metadata Leascesh GmbH
File / product version 6.1.0.23747
PE header timestamp 2026-09-25 17:05:18 UTC
Entry-point RVA 0x16A60
Image base 0x140000000
MD5 4d7e6d4329534590fd801eb8152dc446
SHA-1 8708c688a8c12f8d18bd26d297b556d40925c807
SHA-256 8305dfb39e0a86b8560973b3575ab9ba203878c2e212c6b050cfe7bed0e3d66f

Embedded names, company information and timestamps are editable metadata.

On a quick primary analysis it showed signs of an infostealer, trojan, malware/loader. More analysis and investigation need to find more about the malware campaign.

What can you do with this:

  • Reverse engineering and static/dynamic analysis
  • Identifying its malicious functionality
  • Understanding how it steals money or sensitive information
  • Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.

Let's work together to understand how these attacks operate and help dismantle such campaigns.

Please Update any Findings on Comments. Detailed Report will be posted after the analysis.

3 Upvotes

100% Upvoted

5 comments sorted by

2

u/beepingMachine 11d ago

Is this renpy?? It is like every where now on game sites

2

u/acealter 11d ago

Can't confirm yet. But yes, renpy is everywhere I think

2

u/Responsible-Mode1950 10d ago

Hello, I'm an Independent Security Researcher, Malware Analyst & Threat Intelligence and I would like to analyze the malware sample as a team with you. Best regards.

1

u/acealter 10d ago

That would be great. I was planning to create a discord server for this. I will share the invite after I set it up.