unclassified-dotnet-crypter-loader: 5f54948e — Transponer masquerade, Unicode name obfuscation, 2.0 MB AES overlay, sixth confirmed sibling

Executive Summary

A .NET Framework 4.0+ x64 crypter/loader compiled September 2024. Two tiny PE sections conceal a ~2.0 MB encrypted payload in the file overlay. Static evidence confirms AMSI bypass via byte-signature patching, AES-CSP decryption, reflective in-memory loading, and native-code bridging via VirtualProtect/LoadLibrary/GetProcAddress. The CIL metadata uses Unicode control-character / Hangul jamo name obfuscation — a technique previously observed in the unrelated unclassified-dotnet-whisper cluster, but applied here to the same crypter-loader codebase as siblings 4e31a886 and 673e6738. Distributed as PO_CW00402902400429.exe under the brand "Transponer" / "Boulloart". Static-only analysis (CAPE skipped — no Windows guest).

What It Is

• SHA-256: 5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254
• Filename: PO_CW00402902400429.exe ^[metadata.json] ^[triage.json]
• Size: 2,107,542 bytes (2.0 MB) ^[exiftool.json]
• Type: PE32+ executable (GUI) x86-64 Mono/.Net assembly, 2 sections ^[file.txt]
• Timestamp: 2024-09-23 16:23:32 UTC ^[pefile.txt:40]
• .NET Target: .NET Framework 4.0+ (v4.0.30319 runtime) ^[strings.txt:5]
• Compiler: csc / Roslyn (evidenced by standard .NET Framework 4.0 mscorlib binding) ^[strings.txt:29]
• Linker: MSVC 14.x (MajorLinkerVersion: 0x30) ^[pefile.txt:51]
• Obfuscator: None identified — no ConfuserEx #=q mangling, no SmartAssembly. CIL type and method names are obfuscated with Unicode control-character / Hangul jamo sequences, identical in technique to unclassified-dotnet-whisper but different namespace. ^[dnfile-metadata]
• Packer: Custom — ~2.0 MB post-.rsrc overlay, AES-CSP encrypted ^[overlay-analysis]
• Signing: Unsigned ^[rabin2-info.txt:27]
• Masquerade: VS_VERSIONINFO uses brand "Transponer" / "Boulloart" with FileDescription "Transponer", ProductName "Transponer", InternalName "Transponer.exe", OriginalFileName "Transponer.exe", Copyright "Copyright © Boulloart 2024" ^[exiftool.json:38-45] ^[pefile.txt:218-228]

How It Works

Payload Staging

The PE has only .text (code, 16.5 KB) and .rsrc (resources, 1.5 KB) sections. The .rsrc directory contains only RT_VERSION and RT_MANIFEST entries — no encrypted payload resource. ^[pefile.txt:83-122]

The real payload sits in the file overlay beginning at raw offset 0x4A00, immediately after .rsrc ends. The overlay is 2,088,598 bytes (99.1 % of file size). Its first 28 bytes are the repeating ASCII string E2RGfIgBr2yorOvHv0c1R1zXtD — present 7 times across the non-padding region, likely a hardcoded AES key/IV, passphrase, or delimiter. The data region terminates with PAPADDINGXX filler padding. ^[overlay-analysis]

Decryption Chain

Static strings show an AES-CSP decryption pipeline:

• AesCryptoServiceProvider ^[strings.txt:124]
• CreateDecryptor ^[strings.txt:134]
• CryptoStream / CryptoStreamMode ^[strings.txt:105,43]
• MemoryStream ^[strings.txt:106]
• SymmetricAlgorithm, ICryptoTransform ^[strings.txt:112,113]
• System.Security.Cryptography ^[strings.txt:178]

No GZipStream, DeflateStream, or Base64 strings were recovered, distinguishing this sibling from the AES→GZip→Base64 chain observed in 07835853. The overlay contains large PAPADDINGXX padding which deflates overall entropy; the actual encrypted region preceding the padding shows high randomness consistent with AES-CSP ciphertext. ^[strings.txt]

AMSI Bypass

Explicit AMSI API references are present, identical in naming to siblings 931242f8, 673e6738, and 4e31a886:

• AmsiInitialize ^[strings.txt:84]
• AmsiOpenSession ^[strings.txt:114]
• AmsiScanBuffer ^[strings.txt:125]
• Get_AmsiOpenSession_Byte ^[strings.txt:78]
• Get_AmsiScanBuffer_Byte ^[strings.txt:79]
• Get_ComplementaryStrings_Byte ^[strings.txt:80]
• Amsi_dll ^[strings.txt:104]

The Get_*_Byte naming convention strongly implies byte-signature scanning of function prologues followed by in-memory patch overwrite — the same technique documented in sibling 931242f8. ^[techniques/amsi-bypass-byte-patch.md]

Native Bridging

After decryption, the payload is bridged into native execution:

• VirtualProtect — marks decrypted pages executable ^[strings.txt:156]
• LoadLibrary / GetProcAddress — runtime API resolution ^[strings.txt:180,151]
• EntryPoint — native entry point invocation ^[strings.txt:160]
• PAGE_EXECUTE_READWRITE — RWX memory allocation flag ^[strings.txt:24]

Capa flags allocate or change RWX memory (host-interaction/process/inject) and link function at runtime on Windows (linking/runtime-linking), corroborating the injection path. ^[capa.txt]

Decompiled Behavior

Ghidra / radare2 CIL analysis reveals 7 TypeDefs and 32 MethodDefs, all with Unicode control-character / Hangul jamo names (e.g., ㇣ㇿᄊᇧᇕㅩ㈢ꦅᅜᅂ for Assembly, ㈢ᅌㆰㇹ㈄ᆕퟻᇧㇲꥺᄦᅂꦥᇃᇷᅢퟨힻᅒꦺퟛꦬㆽㅈퟗꦉᄁꦎꥩ for primary TypeDef). Method names like .ctor, get_Tag, set_Tag, HookProc, RunDialog, OnHelpRequest, OwnerWndProc, Reset, VirtualProtect, LoadLibrary, GetProcAddress, and .cctor survive as plaintext symbols. ^[dnfile-metadata] ^[r2:fcn.00402000–fcn.004027b3]

The inferred entry-point flow is:

Main → RunDialog / HookProc → overlay read (File.ReadAllBytes via get_Location + ReadAllBytes MemberRef) → AES CreateDecryptor → Assembly.Load or native InjectMem → VirtualProtect (RXW) → EntryPoint / Invoke.

ComplementaryStrings is the primary payload orchestrator / delimiter splitter; Get_ComplementaryStrings_Byte likely handles the overlay magic string parsing. ^[strings.txt:145,80]

C2 Infrastructure

No network indicators recovered statically. The overlay is AES-encrypted; C2 config expected to be runtime-decrypted from the inner payload. No hardcoded IPs, domains, URLs, mutex names, or named pipes observed in the outer binary. ^[strings.txt]

Interesting Tidbits

• Sixth confirmed sibling of the unclassified-dotnet-crypter-loader cluster. Shares method names (ComplementaryStrings, Get_AmsiOpenSession_Byte, Get_AmsiScanBuffer_Byte, VirtualProtect, LoadLibrary, GetProcAddress) with siblings 4e31a886 and 673e6738, confirming a common builder or copy-paste codebase. ^[strings.txt:78-180]
• Unicode name obfuscation is new to this cluster — prior siblings used unobfuscated CIL (Get_Malware, InjectMem) or ConfuserEx alphanumeric mangling (07835853). This sample applies Hangul jamo / Unicode control-character renaming to the same codebase, suggesting either a post-build obfuscation pass or a new builder variant. ^[dnfile-metadata]
• Overlay magic E2RGfIgBr2yorOvHv0c1R1zXtD — 28-character ASCII string, not valid standard Base64 (decodes to 19 bytes with forced padding). May be a passphrase for Rfc2898DeriveBytes (PBKDF2) key derivation rather than a raw AES key. ^[overlay-analysis]
• Masquerade brand "Boulloart" — no known legitimate software by this name; likely an invented word to populate VS_VERSIONINFO and lend false legitimacy during triage.
• PE entry point at 0x0 — AddressOfEntryPoint: 0x0, outside section boundaries. This is a legal .NET PE pattern (the CLR ignores the native entry point and uses the token in the COM descriptor), but it triggers pefile warnings. ^[pefile.txt:3,56]
• No import table — IMAGE_DIRECTORY_ENTRY_IMPORT RVA and Size are both zero. All API resolution is runtime via P/Invoke or LoadLibrary/GetProcAddress. ^[pefile.txt:129-130]

How To Mess With It (Homelab Replication)

Toolchain

• Compiler: Visual Studio 2022 / .NET Framework 4.8 Developer Pack
• Language: C#
• Target: AnyCPU or x64 console/GUI

Working Source Snippet

A minimal reproducer that matches the capa fingerprint of this sample:

using System;
using System.IO;
using System.Security.Cryptography;
using System.Reflection;
using System.Runtime.InteropServices;

class Transponer
{
    [DllImport("kernel32")] static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
    [DllImport("kernel32")] static extern IntPtr LoadLibrary(string lpFileName);
    [DllImport("kernel32")] static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);

    static void Main()
    {
        byte[] overlay = File.ReadAllBytes(Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "payload.bin"));
        string magic = "E2RGfIgBr2yorOvHv0c1R1zXtD";
        // Split on magic, decrypt AES-CSP block
        // ...
    }
}

Verification Step

Compile and run capa reproducer.exe. Expected hits: read file in .NET, manipulate unmanaged memory in .NET, allocate or change RWX memory, link function at runtime on Windows, unmanaged call, compiled to the .NET platform.

What You'll Learn

How a trivial C# wrapper can hide a 2 MB payload in the PE overlay, decrypt it with AesCryptoServiceProvider, and bridge into native code — and why capa sees process-injection capability even though no injection API is directly imported.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNetCrypterLoader_5f54948e
{
    meta:
        description = "Detects unclassified-dotnet-crypter-loader sibling 5f54948e — Transponer masquerade, AES-CSP overlay, AMSI bypass"
        author = "PacketPursuit"
        date = "2026-07-11"
        sha256 = "5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254"
        family = "unclassified-dotnet-crypter-loader"
    strings:
        $magic = "E2RGfIgBr2yorOvHv0c1R1zXtD"
        $amsi1 = "Get_AmsiOpenSession_Byte"
        $amsi2 = "Get_AmsiScanBuffer_Byte"
        $amsi3 = "Get_ComplementaryStrings_Byte"
        $amsi4 = "AmsiInitialize"
        $amsi5 = "AmsiOpenSession"
        $amsi6 = "AmsiScanBuffer"
        $comp = "ComplementaryStrings"
        $vp = "VirtualProtect"
        $ll = "LoadLibrary"
        $gpa = "GetProcAddress"
        $trans = "Transponer.exe"
        $boul = "Boulloart"
        $aes = "AesCryptoServiceProvider"
        $padding = "PAPADDINGXX"
    condition:
        uint16(0) == 0x5A4D and
        ($magic or $padding) and
        3 of ($amsi*) and
        $comp and
        ($vp or $ll or $gpa) and
        ($trans or $boul or $aes)
}

Sigma Rule

title: .NET Crypter Loader AMSI Bypass and Overlay Execution
status: experimental
description: Detects .NET processes exhibiting AMSI bypass strings, VirtualProtect, and large file overlay read patterns consistent with unclassified-dotnet-crypter-loader family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Transponer.exe'
            - 'PO_CW00402902400429'
    amsi_indicators:
        - ImageLoaded|endswith: 'amsi.dll'
        - CommandLine|contains:
            - 'AmsiInitialize'
            - 'AmsiScanBuffer'
            - 'VirtualProtect'
    selection_memory:
        CommandLine|contains:
            - 'VirtualProtect'
            - 'LoadLibrary'
            - 'GetProcAddress'
    condition: selection and (amsi_indicators or selection_memory)
falsepositives:
    - Legitimate .NET security research tools
level: high

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework PE32+ with exactly two sections (.text, .rsrc), zero import table, and a ~2 MB file overlay containing a repeating ASCII magic string (E2RGfIgBr2yorOvHv0c1R1zXtD) followed by encrypted data and PAPADDINGXX filler. At runtime it resolves amsi.dll exports (AmsiInitialize, AmsiOpenSession, AmsiScanBuffer), scans their prologues for known byte signatures, and patches them in-memory via VirtualProtect. It then decrypts the overlay using AesCryptoServiceProvider + CryptoStream + MemoryStream, and loads the resulting payload reflectively via Assembly.Load or native EntryPoint invocation. No hardcoded C2 strings exist in the outer binary; network configuration is expected to be embedded in the encrypted inner payload. The CIL metadata uses Unicode control-character / Hangul jamo name obfuscation, but plaintext method names .ctor, VirtualProtect, LoadLibrary, GetProcAddress, ComplementaryStrings, RunDialog, and HookProc survive.

Detection Signatures (capa → ATT&CK)

References

• Artifact ID: 7bc79da0-cac9-49f1-bcf4-4bd3b3056f00
• Source: MalwareBazaar / OpenCTI connector
• Related wiki pages: unclassified-dotnet-crypter-loader, unclassified-dotnet-whisper, amsi-bypass-byte-patch, unicode-control-character-name-obfuscation, unclassified-dotnet

Provenance

• file.txt — file(1) output ^[file.txt]
• exiftool.json — VS_VERSIONINFO, timestamp ^[exiftool.json]
• pefile.txt — PE header, section layout, data directories ^[pefile.txt]
• strings.txt — ASCII/Unicode string extraction ^[strings.txt]
• capa.txt — Mandiant capa v8 static analysis ^[capa.txt]
• rabin2-info.txt — radare2 binary info ^[rabin2-info.txt]
• binwalk.txt — embedded artefact scan ^[binwalk.txt]
• dnfile — Python dnfile 0.18.0 CLR metadata parsing ^[dnfile-metadata]
• radare2 — CIL disassembly and function listing ^[r2:fcn.00402000–fcn.004027b3]
• dynamic-analysis.md — CAPE status (skipped, no Windows guest) ^[dynamic-analysis.md]