unclassified-dotnet-protobuf-loader: 6cdc73c8 — Signed .NET RAT with protobuf-net C2, Smadav masquerade

Executive Summary

A .NET Framework PE32 binary masquerading as "Smadav Updater" and signed with a valid Sectigo code-signing certificate. Internally it carries protobuf-net serialization, System.ServiceModel (WCF) networking, and heavy reflection.Emit usage — a build stack consistent with a modular RAT or reflective loader rather than the legitimate AV updater it claims to be. No runtime detonation available (CAPE skipped — no Windows guest), so all behaviour is static inference. ^[file.txt] ^[pefile.txt] ^[capa.txt]

What It Is

The VS_VERSIONINFO is a complete fabrication: "Smadav" is a real Indonesian antivirus product, but the binary contains no Smadav code. The certificate chain is valid and unrevoked at time of analysis, which will satisfy Windows SmartScreen and many EDR trust models. ^[pefile.txt] ^[exiftool.json]

How It Works

Build / RE

Toolchain. Compiled as a .NET Framework 4.x PE32 with standard MS IL. No native AOT, no ConfuserEx, no SmartAssembly — the IL metadata is fully intact and readable. CLR string heap reveals the full type surface. ^[rabin2-info.txt]

No packing. The .text section entropy is 7.84 (high for IL, but consistent with merged protobuf-net and WCF library code). No UPX, Themida, or custom packer signatures. The binary is effectively a self-contained .NET deployment with third-party libraries merged or embedded. ^[pefile.txt] ^[binwalk.txt]

Libraries merged/embedded. Static namespace analysis reveals:

• ProtoBuf — protobuf-net serialization library (IExtensible, IExtension, Meta, ServiceModel namespaces) ^[rabin2-info.txt]
• System.ServiceModel — WCF client/service model, channels, dispatcher, description ^[rabin2-info.txt]
• System.Reflection.Emit — DynamicAssembly, ILGenerator usage for runtime code generation ^[capa.txt]
• System.Security.Cryptography — AES, DES, TripleDES, Rijndael, RC2 (multi-cipher support) ^[capa.txt] ^[strings.txt]

Anti-analysis. Capa flags reference analysis tools strings ^[capa.txt]. No VM/debug/VMware-specific strings were recovered, but the .NET runtime is configured with canary: true, nx: true, pic: true ^[rabin2-info.txt], indicating standard compilation with security mitigations rather than deliberate evasion.

Embedded data. A 232-byte Base64-decoded ciphertext sits in the CLR User String (#US) heap — likely an encrypted config blob or small payload. Decoded bytes show high entropy (no zlib magic, no PEM/DER structure). The string is not a standard .NET settings block; it is referenced at runtime and decrypted. ^[strings.txt]

Deploy / ATT&CK

TTPs (all static inference — no CAPE detonation).

C2 Infrastructure. No hardcoded IPs, domains, or URLs recovered. The use of System.ServiceModel (WCF) suggests the C2 endpoint is configured in the encrypted payload or fetched at runtime. The protobuf-net serialization layer implies structured binary messages over WCF channels — a more sophisticated protocol than raw TCP or HTTP POST. Static inference only; runtime C2 is opaque. ^[rabin2-info.txt]

Persistence. No registry keys, scheduled tasks, or startup folder paths found in strings. Persistence may be established by the decrypted second stage. ^[strings.txt]

Decompiled Behavior

Radare2 analysis (level 3) found 2,677 CIL functions. No Ghidra decompilation was performed — the CIL metadata is sufficient for static characterization. Notable function categories observed: ^[rabin2-info.txt]

• ProtoBuf.Meta — runtime type model construction for protobuf serialization
• System.ServiceModel.Description.IOperationBehavior — WCF operation contract behaviors (client-side or service-side dispatch)
• System.Reflection.Emit.ILGenerator — dynamic IL emission for runtime method generation
• System.Security.Cryptography.Aes / CryptoStream — symmetric decryption pipeline

The entry point (entry0) is standard .NET PE entry through mscoree.dll!_CorExeMain. ^[pefile.txt]

C2 Infrastructure

• Protocol: Inferred WCF-over-TCP or WCF-over-HTTP with protobuf-net binary serialization
• Endpoint: Runtime-resolved (no static strings)
• Config carrier: 232-byte encrypted blob in #US heap (Base64-encoded at rest)
• Certificate: Valid Sectigo code-signing chain embedded in PE security directory ^[pefile.txt]

No IPs, domains, mutexes, or named pipes recovered statically.

Interesting Tidbits

1. Signed masquerade. The valid Sectigo certificate plus "Smadav Updater" version info is deliberately chosen to exploit trust in Indonesian AV software. This is more sophisticated than self-signed or unsigned variants. ^[pefile.txt] ^[exiftool.json]
2. Protobuf + WCF is unusual. Most commodity .NET RATs (AsyncRAT, Quasar, NanoCore) use raw TCP or HTTP with MessagePack/JSON/protobuf-lite. Full WCF service model with protobuf-net suggests either a custom builder or a repurposed enterprise/internal tool. ^[rabin2-info.txt]
3. Reflection.Emit count. 39 matches for runtime method generation is unusually high — this may be a dynamically-compiled plugin loader or a crypter that JIT-decrypts methods. ^[capa.txt]
4. Multi-cipher support. Presence of AES, DES, TripleDES, Rijndael, and RC2 in the crypto namespace suggests a configurable encryption layer, possibly switching ciphers per campaign. ^[strings.txt]
5. No anti-VM, no sandbox evasion. Unlike most .NET malware in this corpus, there are no vmware, vbox, sandboxie, or IsDebuggerPresent strings. The author relied on the certificate and masquerade for evasion. ^[strings.txt]

How To Mess With It (Homelab Replication)

Goal: Build a minimal .NET binary that produces a comparable capa fingerprint (protobuf + WCF + reflection + AES).

1. Create a new .NET Framework 4.8 Console project in Visual Studio.
2. NuGet: Install-Package protobuf-net and System.ServiceModel.
3. Add a WCF service contract with [OperationContract] and protobuf [ProtoContract] data classes.
4. Add a System.Reflection.Emit.DynamicMethod that generates a simple delegate at runtime.
5. Encrypt a small JSON config with AesManaged + Convert.ToBase64String, embed as a string literal.
6. At runtime: Base64-decode → AES-decrypt → Assembly.Load(byte[]) → invoke via reflection.
7. Compile with csc.exe or MSBuild with default flags.

Verification: Run capa reproducer.exe. Expected hits: compiled to the .NET platform, generate method via reflection, invoke .NET assembly method, load .NET assembly, decode data using Base64, decrypt data using AES.

Deployable Signatures

YARA Rule

rule unclassified_dotnet_protobuf_loader_6cdc73c8 {
    meta:
        description = ".NET PE with protobuf-net + WCF + heavy reflection + Smadav masquerade"
        author = "PacketPursuit"
        date = "2026-07-04"
        sha256 = "6cdc73c825f3c1dd9d61f8ba2cc4f8a7c43f1236d94f196191c7a2a922ecb3d9"
        confidence = "medium"
    strings:
        $dotnet = "BSJB" ascii
        $smadav1 = "Smadav Updater" wide
        $smadav2 = "Smadsoft" wide
        $smadav3 = "Revised_506133.exe" wide
        $proto1 = "ProtoBuf.IExtensible" wide
        $proto2 = "ProtoBuf.Meta" wide
        $wcf1 = "System.ServiceModel.Description.IOperationBehavior" wide
        $reflect1 = "System.Reflection.Emit" wide
        $crypto1 = "System.Security.Cryptography" wide
        $aes1 = "CreateDecryptor" wide
        $manifest = "Assembly Version" wide
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_signatures > 0 and
        $dotnet and
        (2 of ($smadav*)) and
        (2 of ($proto*)) and
        $wcf1 and
        $reflect1 and
        $crypto1 and
        filesize < 2MB
}

Behavioral Hunt Query (KQL)

DeviceProcessEvents
| where ProcessVersionInfoProductName contains "Smadav" 
    or ProcessVersionInfoCompanyName contains "Smadsoft"
| where InitiatingProcessCommandLine !contains "smadav" // exclude legit Smadav if known
| where ProcessCommandLine contains "Revised" 
    or FileName startswith "Revised_"
| summarize count() by DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256

IOC List

Behavioral Fingerprint

This binary is a .NET Framework PE with a valid Authenticode signature and fake "Smadav Updater" version metadata. At runtime it uses System.Reflection.Emit to generate methods dynamically, loads additional assemblies via Assembly.Load(byte[]), and communicates over WCF channels serialized with protobuf-net. It decrypts embedded configuration using .NET AesManaged after Base64-decoding from the assembly's user string heap. No anti-VM or anti-debug checks are present; evasion relies on the signed certificate and benign masquerade identity.

Detection Signatures

^[capa.txt]

References

• Artifact ID: 9a69de47-3c9a-4ac7-8107-dfd2237e14a8
• Source: MalwareBazaar / OpenCTI
• Related wiki pages: unclassified-dotnet-protobuf-loader, reflective-assembly-delegate-execution, dotnet-manifest-resource-decryption

Provenance

Analysis derived from static artifacts generated by the triage pipeline on 2026-05-26: file (libmagic), exiftool, pefile (Python pefile), strings, ssdeep, tlsh, yara, binwalk, radare2 (rabin2 -I), flare-capa (static analysis). No dynamic execution performed — CAPE skipped due to no Windows guest available. All behavioural claims are static inference and marked accordingly.