Cities Skylines II Malware [FULL REVERSE ENGINEERING ANALYSIS]

Downloading mods for video games carries significant malware risks, as highlighted by a recent City Skylines 2 security incident where thousands of players were potentially compromised through a malicious traffic mod 0:00. The malware was distributed through a trusted modding community when an outside actor pushed a malicious DLL file in an update 0:40.

Key Takeaways:
• The malware was a multi-stage payload with the initial DLL containing an encrypted second stage that was XOR-decrypted with hex key 0x33 during execution 15:36 & 19:44
• The second stage used advanced techniques like PEB walking to reflectively load libraries without leaving obvious import traces 31:02
• The malware implemented a custom hashing algorithm to reference DLLs and functions by hash values rather than direct string references, making signature detection more difficult 41:22

This incident demonstrates how even trusted modding communities can be compromised, highlighting the importance of security awareness when downloading game modifications 0:14.

Sources:

• 0:00-0:14 Introduction to malware risks in modding communities
• 0:40-0:55 City Skylines 2 security incident details
• 15:36-15:57 First stage malware analysis revealing XOR encryption
• 19:44-20:07 XOR decryption process with hex key 0x33
• 31:02-31:19 PEB walking explanation for reflective loading