9829594064f43ab1c956b329d897a1fab676742ea84f4da7673fde6cf0dc69c6SHA-256: 9829594064f43ab1c956b329d897a1fab676742ea84f4da7673fde6cf0dc69c6
Family: unattributed (medium confidence) Type: .NET x64 self-contained binary Tags: rat, backdoor, dotnet, obfuscated, websocket, reflective-loading
1. Build / RE
Toolchain: .NET 6.0.36, self-contained, single-file publish, trimmed, x64. ^[file.txt] ^[rabin2-info.txt:1-33]
Assembly identity: Original module name Noit.exe ^[strings.txt:8719] with root namespace FotFin ^[strings.txt:8858] and embedded resources FotFin.Form1.resources ^[strings.txt:9061] and Noit.Properties.Resources.resources ^[strings.txt:9397]. Noit.Properties appears as a property namespace ^[strings.txt:9071]. These names appear to be developer-chosen rather than generated.
Obfuscation: Heavy. Most meaningful strings are replaced with garbage (CZGwDCEsywxZZUZfkyhhx ^[strings.txt:9308]) or control-flow flattened. Capa reports 58 unmanaged-call matches and 54 unmanaged-memory-manipulation matches, indicating extensive P/Invoke interop wrapped in obfuscated wrappers. ^[capa.txt:84-85] FLOSS failed to decode stacked strings due to CLI argument error, so no decoded string layer is available. ^[floss.txt:1-6]
Embedded resources: Three .NET resources detected by capa ^[capa.txt:57]; binwalk finds a 256×256 PNG icon and zlib-compressed data at offset 0x9AE59. ^[binwalk.txt:8-9]
Signing: Unsigned. ^[rabin2-info.txt:27]
YARA: Detected as DarkCrystal_RAT and Fynloski (DarkComet RAT family). ^[yara.txt:1-2] This is likely a false positive or shared-code-pattern hit — the original DarkComet toolchain was Delphi / .NET 2.0, whereas this sample is .NET 6.0 self-contained. No direct code-reuse evidence is visible; treat as unattributed until a sibling cluster confirms the family.
Notable imports: Only _CorExeMain from mscoree.dll (typical for .NET single-file). ^[rabin2-info.txt:1] All Win32 API access is via P/Invoke through obfuscated wrappers.
2. Deploy / ATT&CK
Static-only inference — no CAPE detonation report is present for this sample.
| TTP | Evidence |
|---|---|
| T1543.003 — Create or Modify System Process::Windows Service | capa flags "persist via Windows service" (2 matches) ^[capa.txt:82-83] |
| T1112 — Modify Registry | capa + ATT&CK mapping ^[capa.txt:27] |
| T1620 — Reflective Code Loading | capa flags "load .NET assembly" ^[capa.txt:81] |
| T1087 — Account Discovery | capa ^[capa.txt:29] |
| T1083 — File and Directory Discovery | capa ^[capa.txt:30] |
| T1012 — Query Registry | 14 key-query matches, 18 value-query matches ^[capa.txt:74-77] |
| T1082 — System Information Discovery | OS version, hostname queries ^[capa.txt:69-70] |
| T1033 — System Owner/User Discovery | session username (2 matches) ^[capa.txt:79] |
| T1569.002 — System Services::Service Execution | capa ^[capa.txt:34] |
| Process control | create (2), terminate (2), suspend thread (10) ^[capa.txt:72-73,80] |
| Mutex | create/open mutex (2 matches) ^[capa.txt:66-67] |
| Unmanaged memory | allocate (2), manipulate (54) — possible injection or PE loading ^[capa.txt:63-65] |
| JSON / WebSocket | Newtonsoft.Json ^[capa.txt:56] and WebSocket string ^[strings.txt:9211] suggest structured C2 over WebSocket or HTTP |
C2 inference: The combination of Newtonsoft.Json ^[capa.txt:56] and WebSocket ^[strings.txt:9211] strongly implies a JSON-over-WebSocket C2 channel. ProcessStartInfo ^[strings.txt:8915] and extensive registry manipulation ^[capa.txt:74-78] support remote command execution and host configuration — classic RAT behavior.
Persistence: Windows service installation (T1543.003) is the primary persistence vector indicated by capa. Registry modification (T1112) may be used for secondary persistence or configuration storage.
Anti-analysis: No explicit VM/debug checks surfaced in static tools, but the heavy obfuscation (garbage strings, flattened control flow, 58 unmanaged-call wrappers) serves as anti-analysis by volume.
Attribution
- Confidence: Medium. YARA hits DarkCrystal / Fynloski, but the .NET 6.0 toolchain is inconsistent with the original DarkComet RAT era. No infrastructure, linguistic, or code-reuse evidence beyond the YARA signature.
- Slug:
unattributed— pending sibling cluster or dynamic confirmation.
Siblings
None catalogued. If a cluster emerges around FotFin / Noit names or the CZGwDCEsywxZZUZfkyhhx string artifact, create a comparison page.
Report generated 2026-07-01. Static-only; no CAPE detonation available.