Infestation executable carried Winnti backdoor

ESET described Infestation as one of three Asian gaming supply-chain cases that shared the same embedded backdoor. Infestation was the clearest active case: the Thai developer Electronics Extreme was still distributing a trojanized build when ESET published its research.

The implant ran before the game. Code added near the PE entry point hooked the C runtime initialization path, decrypted an embedded DLL with RC4, launched the backdoor in memory, then resumed normal execution. That shape suggested a build-configuration or build-environment compromise rather than a simple post-download patch.

The backdoor reported host details, including user name, computer name, Windows version, system language, and a MAC-derived bot identifier. Commands were limited but useful: download a file, download and run a file, run a downloaded binary in memory, or disable callbacks through a registry flag.

The Infestation-specific C2 used nw.infestexe.com, a domain built to look related to the game. ESET also saw a Winnti second stage delivered from related infrastructure. This record stays scoped to Infestation even though the broader ESET report covered two other compromised game or gaming-platform products.