RPGM Completed Serena of the Corrupted Mines [Final] [MarunomiKobo]

3.20 star(s) 13 Votes
Discussion Reviews (13)
Y

youraccount69

I'm like a karate chop
Donor
Dec 30, 2020
9,018
4,121
436
SerenaOfTheCorruptedMines-1.0
You don't have permission to view the spoiler content. Log in or register now.
rpdl torrents are unaffiliated with F95Zone and the game developer.
Please note that we do not provide support for games.
For torrent-related issues use here, or join us on
You must be registered to see the links
!
You must be registered to see the links
,
You must be registered to see the links
. Downloading issues? Look here.​
 
Khalic

Khalic

Newbie
Feb 6, 2023
49
34
28
I checked just in case in a virtual machine to see if the archive was good to run and well through Hybrid Analysis in a controlled sandbox environment, and the results indicate it as a high-risk malicious file.


The dynamic analysis showed typical malware behaviors:

  • Virtual environment evasion – tries to avoid detection in virtual machines.
  • Registry modifications – can alter Windows registry keys, which is commonly used for persistence.
  • Process creation/modification – may attempt to establish persistent or elevated processes.
  • DLL injection – injects code into legitimate processes, making detection harder.

    Techniques detected (MITRE ATT&CK)

    The sandbox mapped 253 indicators to 134 techniques and 12 tactics, including:
    • T1592.003 – Firmware information gathering
    • T1106 – Native API execution
    • T1559 – Inter-process communication
    • T1059.003 – Windows command shell usage
    • T1569.002 – Service execution
    • T1129 – Shared modules
  • These are commonly associated with advanced malware, trojans, and remote access tools.

Even if in virus total it looks like a false positive because zillya is not the greatest one
You must be registered to see the links

1757051905364.png


The results of hybrid analysis
You must be registered to see the links


1757052439216.png

I do not recommend to run this file on your main PC. Even if antivirus doesn’t flag it, its behavior indicates it’s malicious. Investigate only in a sandbox or virtual machine.

Because based on the Hybrid Analysis report, the file could:


  1. Establish persistence
    • Modify Windows registry keys or create services so it runs automatically after reboot.
  2. Execute code in other processes
    • Uses DLL injection to hide inside legitimate Windows processes.
  3. Run malicious commands
    • Executes commands through Windows shell to manipulate the system.
  4. Communicate over the network
    • Potentially connects to external servers (could download more malware or send data).
  5. Other advanced malware actions
    • Gather system or firmware information, potentially open backdoors, or install additional malicious modules.
While I have tried to interpret the data accurately, I cannot guarantee that it is 100% correct, im not a malware expert so i hope that somebody double check what i just said o7

Also I used the file in GoFile link pinned in the OP to run the tests
 
Last edited:
  • Like
  • Wow
Reactions: Coolbub, Anon2334, cuervopalido and 12 others
D.K

D.K

Member
Nov 3, 2017
135
290
287
Khalic said:
I checked just in case in a virtual machine to see if the archive was good to run and well through Hybrid Analysis in a controlled sandbox environment, and the results indicate it as a high-risk malicious file.


The dynamic analysis showed typical malware behaviors:

  • Virtual environment evasion – tries to avoid detection in virtual machines.
  • Registry modifications – can alter Windows registry keys, which is commonly used for persistence.
  • Process creation/modification – may attempt to establish persistent or elevated processes.
  • DLL injection – injects code into legitimate processes, making detection harder.

    Techniques detected (MITRE ATT&CK)

    The sandbox mapped 253 indicators to 134 techniques and 12 tactics, including:
    • T1592.003 – Firmware information gathering
    • T1106 – Native API execution
    • T1559 – Inter-process communication
    • T1059.003 – Windows command shell usage
    • T1569.002 – Service execution
    • T1129 – Shared modules
  • These are commonly associated with advanced malware, trojans, and remote access tools.

Even if in virus total it looks like a false positive because zillya is not the greatest one
You must be registered to see the links

View attachment 5219745


The results of hybrid analysis
You must be registered to see the links


View attachment 5219776

I do not recommend to run this file on your main PC. Even if antivirus doesn’t flag it, its behavior indicates it’s malicious. Investigate only in a sandbox or virtual machine.

Because based on the Hybrid Analysis report, the file could:


  1. Establish persistence
    • Modify Windows registry keys or create services so it runs automatically after reboot.
  2. Execute code in other processes
    • Uses DLL injection to hide inside legitimate Windows processes.
  3. Run malicious commands
    • Executes commands through Windows shell to manipulate the system.
  4. Communicate over the network
    • Potentially connects to external servers (could download more malware or send data).
  5. Other advanced malware actions
    • Gather system or firmware information, potentially open backdoors, or install additional malicious modules.
While I have tried to interpret the data accurately, I cannot guarantee that it is 100% correct, im not a malware expert so i hope that somebody double check what i just said o7

Also I used the file in GoFile link pinned in the OP to run the tests
Click to expand...
The only reason it's tagged in both Hybrid and VirusTotal is because of Zillya. Unless another AV some how picks it up as a virus (news flash, you could've just looked up the trojan itself and actually found a thread from 2 years ago talking about the very trojan), it's almost guaranteed a false positive.
 
  • Thinking Face
Reactions: Khalic
Khalic

Khalic

Newbie
Feb 6, 2023
49
34
28
D.K said:
The only reason it's tagged in both Hybrid and VirusTotal is because of Zillya. Unless another AV some how picks it up as a virus (news flash, you could've just looked up the trojan itself and actually found a thread from 2 years ago talking about the very trojan), it's almost guaranteed a false positive.
Click to expand...
Tbh I mostly didn’t trust the file because of the hybrid sandbox results that detected a suspicious behavior. Because like you said in the AV is just Zillya who detected it in both cases, but what concerns me a bit is the analysis that im assuming is more reliable than a single static AV detection.
 
petweiss

petweiss

Newbie
Jun 24, 2022
36
104
147
I was disappointed with the game. Apparently you only get the good ending if you don’t corrupt the heroine in a certain amount, but when you go to farm EXP, you end up being forced to face monsters that have a high chance of corrupting you. It is difficult to play like this.
 
A

Arenadelson1

Newbie
May 16, 2024
38
63
94
Lmao what an anticlimatic ending. Win random boss fight against some mid rank goon, get your throat slit anyway and die. Not even the devs wanted to continue with this trash.
 
L

lusciousboy01

Member
Nov 15, 2017
160
391
268
petweiss said:
I was disappointed with the game. Apparently you only get the good ending if you don’t corrupt the heroine in a certain amount, but when you go to farm EXP, you end up being forced to face monsters that have a high chance of corrupting you. It is difficult to play like this.
Click to expand...
What? No, no, no.
There is only one thing that determines the ending path.
To get the good ending, you need to receive the "Signal Orb" from the female engineer and you need to have it equipped during the final confrontation.

If you have the "Signal Orb", miners rescue Serena after she's defeated.
If you don't have it, Serena gets her throat slit and die in the darkness.
 
  • Like
Reactions: Gihaar, The New Order, flannan and 3 others
You must log in or register to reply here.
Top Bottom
3.20 star(s) 13 Votes