Deep Analysis — 673e673800b8…4421

Overview

Fourth confirmed sibling of the unclassified-dotnet-crypter-loader family. Unobfuscated .NET Framework PE32+ x64 compiled Fri 26 Jul 2024. Carries a ~2.1 MB AES-encrypted payload in a raw file overlay, preceded by a repeating 19-byte magic string. Distinctive developer-chosen method names (Fatetpopet2, HolyDamn, FuckUpAgain, ToPutt, ComplementaryStrings) set it apart from prior siblings. Distributed as нова_поръчка_pdf.exe (Bulgarian "new order") with a double-extension-masquerade and fabricated VS_VERSIONINFO. CAPE skipped — static-only assessment. ^[file.txt] ^[metadata.json] ^[exiftool.json]

Build / RE

Toolchain. .NET Framework 4.0+ C# / csc (PE32+, 2 sections, compiled Fri Jul 26 22:23:35 2024). Linker v48.0 (IL linker / .NET Native ILC build chain). ^[rabin2-info.txt] ^[pefile.txt:88]

Packing / obfuscation. None. CIL metadata is unobfuscated; class and method names are human-readable. No ConfuserEx, SmartAssembly, or PyArmor signatures. Entire IAT is empty — the binary is fully static .NET. ^[strings.txt:6-267]

Overlay / payload staging. The PE has two tiny sections (.text 0x4C00, .rsrc 0xA00) but the file is 2.1 MB. A ~2.1 MB raw overlay begins at offset 0x5800. The first bytes of the overlay repeat the 19-byte magic 5YHKDOtYsVE2kKl2Ok, suggesting a hardcoded key or delimiter rather than random ciphertext. No GZip or Base64 layer is present in strings. ^[pefile.txt:104-109] ^[overlay:0x5800]

Crypto. AesCryptoServiceProvider, SymmetricAlgorithm, ICryptoTransform, CreateDecryptor, and TransformFinalBlock in CIL metadata. This variant uses the FIPS-compliant AES-CSP provider rather than AesManaged seen in sibling 931242f8…. ^[strings.txt:136-187]

Anti-analysis / AMSI bypass. Explicit AMSI export resolution and byte-patch bypass:

• Get_AmsiOpenSession_Byte ^[strings.txt:109]
• Get_AmsiScanBuffer_Byte ^[strings.txt:110]
• AmsiInitialize, AmsiOpenSession, AmsiScanBuffer ^[strings.txt:118-177]
• P/Invoke pairs: LoadLibrary("Amsi_dll") / GetProcAddress ^[strings.txt:141-219]
• VirtualProtect to mark target pages executable before patch ^[strings.txt:227]
• ModifyMemory — wrapper for the in-memory patch routine ^[strings.txt:267]

Reflection / runtime loading. System.Reflection, System.Reflection.Emit, Assembly, Invoke, CompileToAssembly, ExecuteMethod, CacheCode, Extract. The payload is decrypted in-memory and then loaded reflectively. ^[strings.txt:71-276] ^[capa.txt]

Version-info masquerade. VS_VERSIONINFO fields are random nonsense word-salad:

• CompanyName: Ayituzizofu
• ProductName: Uzafoyaragofokopotike
• FileDescription: Ijubebayarudoloror Esirosekakiye Igefivix Owunewavib.
• OriginalFileName: Iciwonukopisicunut
• InternalName: Ugemiduwap
• LegalCopyright: © 2027 Ayituzizofu
• FileVersion: 4.99.682.71

This is the same word-salad pattern observed in sibling bc38233e…. ^[exiftool.json] ^[strings.txt:95-107]

Notable functions. The following names appear in CIL and are worth singling out for YARA / hunting:

• Fatetpopet2 ^[strings.txt:12]
• HolyDamn ^[strings.txt:155]
• FuckUpAgain ^[strings.txt:152]
• ToPutt ^[strings.txt:247]
• ComplementaryStrings ^[strings.txt:202]
• Get_Malware ^[strings.txt:76]
• InitializeReferences ^[strings.txt:193]
• Get_IV / Get_Key ^[strings.txt:26-261]

Entry-point flow (inferred). Main → InitializeReferences → Get_Malware → overlay read → AES Decrypt → Assembly.Load → Invoke / ExecuteMethod. CompileToAssembly and CacheCode suggest the payload may be a compiled script or expression tree rather than a raw PE. ^[ghidra:Main-00402220] ^[ghidra:Get_Malware-0040213b] ^[ghidra:Decrypt-004033b0]

Deploy / ATT&CK

Persistence. No persistence mechanisms observed in static strings. Outer layer is a pure loader; persistence would be established by the decrypted inner payload (not recoverable statically).

C2 / network. No hardcoded URLs, IPs, or domain strings in the outer binary. The inner payload would handle C2. No System.Net references in CIL strings.

Social engineering. Distribution filename нова_поръчка_pdf.exe (Bulgarian "new order_pdf.exe") is a double-extension-masquerade targeting procurement / AP staff. This aligns with the purchase-order lure pattern seen in siblings bc38233e… (PO1.exe) and 931242f8… (P.O_.exe). ^[metadata.json]

Attribution. No linguistic or infrastructure overlap beyond the generic purchase-order lure theme. The nonsense word-salad version info (Ayituzizofu, Uzafoyaragofokopotike) is generated by the same crypter/builder used for sibling bc38233e…, but the method-name vocabulary (Fatetpopet2, HolyDamn, FuckUpAgain) is unique to this build. This suggests either a different customer of the same crypter service, or a forked builder.

IOCs

Related Pages

• unclassified-dotnet-crypter-loader — Family entity (fourth confirmed sibling)
• unclassified-dotnet — Umbrella entity for unattributed .NET malware
• amsi-bypass-byte-patch — AMSI in-memory patch technique
• version-info-masquerade — VS_VERSIONINFO word-salad masquerade
• reflective-assembly-delegate-execution — .NET reflective loading pattern
• aes-managed-overlay-decryption — AES overlay payload-staging concept
• social-engineering-purchase-order-masquerade — Purchase-order lure pattern
• double-extension-masquerade — .pdf.exe extension abuse