unclassified-dotnet-bitmap-stego-loader: a497a066 — 21-bitmap maritime-lure sibling, Feb 2020 build

Executive Summary

Seventh confirmed sibling of the .NET bitmap-stego loader cluster. PE32 GUI assembly compiled 29 Feb 2020, embedding 21 encrypted 76×76×24 bitmap payloads in .rsrc — the highest bitmap count among confirmed siblings and matching the early-cluster baseline. Masquerades as a maritime shipping document (vessel's_mainiculars.exe). RijndaelManaged + SHA256 strings, SoapHttpClientProtocol network surface, and heavy alphanumeric name mangling. Static-only; no runtime C2 recovered. ^[file.txt]

What It Is

• SHA-256: a497a066fe94fbfad7361eee98b725cc0c32be13bd0c1742d010a98c97a483d7
• Filename: vessel's_main_particulars.exe ^[metadata.json]
• Size: 1,031,168 bytes (1.0 MB)
• Format: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, 3 sections ^[file.txt]
• Timestamp: Sat Feb 29 14:36:14 2020 UTC (leap-day build) ^[rabin2-info.txt]
• Framework: .NET Framework 4.6 (assembly version 1.0.0.0) ^[strings.txt:3731]
• Linker: Version 8.0 (Visual Studio / MSBuild toolchain) ^[exiftool.json]
• Family: Confirmed sibling of unclassified-dotnet-bitmap-stego-loader (n=7). Static-only analysis.

How It Works

Masquerade & Social Engineering

The filename vessel's_main_particulars.exe targets maritime/shipping-sector victims — a procurement or logistics employee expecting a vessel specification sheet. The VS_VERSIONINFO block carries fabricated nonsense strings: company name H?<??;>=AE:FC9C8BEJ, product name 75D49;EJ?CEGCFBD, internal name done.exe, version 10.21.32.8. ^[exiftool.json] This is consistent with the cluster's pattern of random-alphanumeric version-info masquerade. ^[entities/unclassified-dotnet-bitmap-stego-loader.md]

Bitmap-Stego Payload Hiding

Binwalk identifies 21 PC bitmap structures (76×76×24) inside .rsrc, spaced at ~17.5 KB intervals starting at offset 0x904C9. ^[binwalk.txt] Each bitmap is the same dimensions as the earliest cluster siblings (4bf14434, f6b5bdd5), but this sample exceeds f230118d (16 bitmaps at 88×88) and d4d106f8 (8 bitmaps at 136×136). The 76×76×24 format is the cluster's original baseline.

Strings confirm System.Drawing.Bitmap references paired with System.Resources.ResourceReader / RuntimeResourceSet — the loader extracts bitmaps from embedded .resources streams at runtime, decrypts them, and reconstructs the inner payload. ^[strings.txt:271,882]

Encryption Chain

• RijndaelManaged — symmetric block cipher for payload decryption ^[strings.txt:2451]
• SHA256 — likely key derivation or integrity check ^[strings.txt:1619]
• CreateDecryptor / CreateEncryptor — confirms managed crypto API use ^[strings.txt:3337,3338]
• System.Security.Cryptography namespace referenced ^[strings.txt:3664]

No DeflateStream or System.IO.Compression strings present — unlike sibling f230118d which added a deflate layer. This sample uses a simpler AES/Rijndael-only decryption chain. ^[strings.txt]

Network Surface

• System.Net.Sockets ^[strings.txt:3428]
• System.Net ^[strings.txt:3482]
• SoapHttpClientProtocol ^[strings.txt:3747]
• IPHostEntry / GetHostEntry ^[strings.txt:3763,3764]

The SoapHttpClientProtocol reference suggests SOAP-over-HTTP C2 or payload staging, shared with siblings f74d8a51 and f6b5bdd5. Sibling d4d106f8 dropped SOAP in favor of System.Net.Http. No hardcoded URLs, IPs, or domains recovered statically.

Reflective Loading

Assembly.Load, Invoke, GetMethod, and GetExecutingAssembly strings present; capa confirms T1620 Reflective Code Loading. ^[capa.txt] The decrypted inner payload is likely a .NET assembly loaded in-memory without disk write.

GUI Shell

Rich WinForms control surface: DataGridView, TreeView, ComboBox, ToolStrip, GroupBox, TabControl, etc. ^[strings.txt:2566-3406] Unlike siblings f74d8a51 (OBD2/service-record GUI) and f230118d (engineering-procurement UI), this sample shows no domain-specific UI strings beyond the filename. The GUI shell may be a generic scaffold or the obfuscator stripped meaningful names.

Decompiled Behavior

Ghidra analysis queued but incomplete at time of writing (background import pending for binary /a497a066fe94fbfad7361eee98b725cc0c32be13bd0c1742d010a98c97a483d7.bin-d1804e). Radare2 confirms the entry point at 0xFD3CE and the standard .NET mscoree.dll!_CorExeMain bootstrap. ^[rabin2-info.txt] No native code of interest; all threat logic lives in obfuscated IL. Decompilation deferred until Ghidra analysis completes.

C2 Infrastructure

No recoverable C2 IOCs from static analysis. No hardcoded URLs, domains, IPs, mutex names, or pipe names. Payload logic is ciphertext inside bitmaps; C2 is runtime-resolved from the decrypted inner assembly. If detonated, network IOCs would surface from the unpacked payload, not the outer loader.

Interesting Tidbits

• Leap-day build timestamp — Feb 29 2020 is unusual; may be fabricated or coincidental, but it places this as the second-earliest known cluster build after f6b5bdd5 (also Feb 2020). ^[rabin2-info.txt]
• 21 bitmaps — ties the record for highest count in the cluster, matching the early-build baseline before later siblings began shrinking and enlarging bitmap dimensions. ^[binwalk.txt]
• Namespace 7Spqmq3WQ_s4j — random alphanumeric mangling consistent across cluster; every sibling has a unique namespace. ^[strings.txt:2834]
• No DeflateStream — the decryption chain here is simpler than the AES+Deflate variant seen in f230118d. ^[strings.txt]
• SoapHttpClientProtocol persistence — this sample retains the SOAP reference lost in the most recent sibling (d4d106f8), suggesting the cluster's C2 stack shifted over time. ^[strings.txt:3747]
• Maritime lure novelty — first confirmed shipping/marine-themed filename in the cluster; prior siblings used purchase-order, quote, payment, and engineering-document lures. ^[metadata.json]

How To Mess With It (Homelab Replication)

Toolchain

• Visual Studio 2019 / MSBuild (Linker 8.0 compatible)
• .NET Framework 4.6 target
• C# WinForms project with embedded ResourceReader streams

Build recipe

1. Create a C# WinForms app. Add 20+ small bitmap resources (76×76×24) to .resx.
2. Encrypt a second-stage .NET assembly with AES-256-CBC.
3. Embed ciphertext into bitmap pixel data (e.g., low-order bit or direct byte overwrite after BMP header).
4. At runtime: ResourceManager.GetObject("bitmap_name") → extract pixel bytes → AES decrypt → Assembly.Load(byte[]) → MethodBase.Invoke.
5. Obfuscate with an off-the-shelf .NET obfuscator (name mangling + string encryption).

Verification

Run capa against the reproducer. Target hits: T1620 Reflective Code Loading, T1027 Obfuscated Files, T1083 File Discovery, T1082 System Information Discovery.

Deployable Signatures

YARA

rule UnclassifiedDotNetBitmapStegoLoader {
    meta:
        description = ".NET bitmap-stego loader cluster — encrypted payload in embedded 76x76 bitmap resources"
        author = "PacketPursuit"
        date = "2026-07-08"
        hash = "a497a066fe94fbfad7361eee98b725cc0c32be13bd0c1742d010a98c97a483d7"
    strings:
        $resreader = "System.Resources.ResourceReader" ascii wide
        $bitmap    = "System.Drawing.Bitmap" ascii wide
        $rijn     = "RijndaelManaged" ascii wide
        $sha256   = "SHA256" ascii wide
        $soap     = "SoapHttpClientProtocol" ascii wide
        $net_sock = "System.Net.Sockets" ascii wide
        $create_dec = "CreateDecryptor" ascii wide
        $create_enc = "CreateEncryptor" ascii wide
        $pe_magic = { 4D 5A }
    condition:
        $pe_magic at 0 and
        $resreader and $bitmap and
        ($rijn or ($create_dec and $create_enc)) and
        ($soap or $net_sock) and
        filesize < 2MB
}

Behavioral hunt query (Sigma-like)

title: .NET Bitmap-Stego Loader Execution
detection:
    selection:
        - ImageLoaded|contains:
            - 'System.Drawing.dll'
            - 'System.Resources.dll'
        - CommandLine|contains:
            - '.exe'
    bitmap_load:
        - ImageLoaded|endswith: 'System.Drawing.dll'
        - ImageLoaded|endswith: 'System.Resources.dll'
    network:
        - InitiatedConnection:
            - DestinationPort: 80
            - DestinationPort: 443
    condition: selection and bitmap_load and network | within 5m

IOC list

Behavioral fingerprint statement

This binary is a .NET Framework PE32 GUI executable with a fabricated version-info block. On launch it loads System.Drawing and System.Resources to access embedded bitmap resources (typically 20+ 76×76 BMPs). It derives an AES/Rijndael key (likely via SHA256 KDF), decrypts pixel data or appended ciphertext from the bitmaps, and reflectively loads the resulting .NET assembly via Assembly.Load + Invoke. Network activity, if present, manifests as SOAP HTTP or raw TCP via System.Net.Sockets. No meaningful plaintext C2 is visible in the outer binary.

Detection Signatures

capa → ATT&CK mapping

References

• unclassified-dotnet-bitmap-stego-loader — Cluster entity page
• dotnet-manifest-resource-decryption — Concept page
• bitmap-steganography-payload-delivery — Concept page (if exists)
• MalwareBazaar entry via OpenCTI connector (artifact fa4196dd-9238-44cd-8a75-28aac783c24e)

Provenance

Analysis derived from:

• file.txt (file type) — file v5.45
• exiftool.json (VS_VERSIONINFO) — ExifTool v12.76
• pefile.txt (PE headers) — pefile v2023.2.7
• strings.txt (static strings) — GNU strings
• capa.txt (capabilities) — Mandiant capa v7.0.1
• binwalk.txt (embedded artefacts) — binwalk v2.3.3
• rabin2-info.txt (radare2 headers) — radare2 v5.9.4
• floss.txt (decoded strings) — flare-floss v3.1.1 (failed: invalid CLI args)
• metadata.json / triage.json (corpus metadata)
• dynamic-analysis.md — CAPE skipped (no Windows guest)
• Ghidra queued import (incomplete at time of analysis)
• radare2 direct inspection (rabin2 strings, header info)

All claims cite source file and line number where applicable.