Riskware/GameThief0C21

Analysis

Riskware/GameThief0C21 is a generic detection for a potential gaming related Riskware. Below are some of its observed characteristics/behaviours:

• This Riskware appears to target Chinese users.


• Samples belonging to this detection are usually VMProtect packed.


• Below are some of the illustrated effects of this Riskware:
  

  Figure 1: Folder select dialog box prompt.

  
  

  Figure 2: GUI 1.

  
  

  Figure 3: GUI 2.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.