AgentTesla: bee6e88e — .NET Native AOT-compiled infostealer, Albanian order-confirmation lure

Executive Summary

A .NET Native AOT-compiled x64 AgentTesla variant, delivered as Konfirmimi_i_porosise.exe (Albanian: "Order Confirmation"). Compiled 2024-09-07 with .NET 8.0.5+ and MSVC 14.41. The Native AOT build strips all CLR metadata, rendering the binary opaque to dnSpy/ILSpy while embedding the full BCL runtime (~2.2 MB). A high-entropy (~7.93) custom BINARY resource (DLI91QTATH07DUVDLZLMHANC68RAZ) likely carries the encrypted C2 configuration or secondary payload. Static-only analysis; CAPE skipped due to no Windows guest.

What It Is

How It Works

1. Delivery & Masquerade

The binary arrives as a fake order-confirmation executable targeting Albanian-speaking victims or Albanian-market businesses. The VS_VERSIONINFO resource is poisoned with a nonsense word-salad string (getEnableUnsafeUTF7EncodingUnorderedNotLessThanSignaling) across all fields — a variant of the version-info-masquerade pattern observed in crypter droppers. ^[exiftool.json:36-42] ^[concepts/version-info-masquerade.md]

2. Anti-Analysis via Native AOT

Unlike traditional AgentTesla samples (which are .NET Framework 4.x assemblies easily reversed in dnSpy), this variant is compiled with .NET Native AOT (<PublishAot>true</PublishAot>). The resulting PE has:

• No CLR header — COM_DESCRIPTOR RVA = 0x0, Size = 0x0 ^[pefile.txt:298-299]
• No IL metadata — defeats dnSpy, ILSpy, de4dot, and most .NET-specific EDR heuristics
• Self-contained runtime — entire BCL (10,000+ strings) inlined, inflating file size to 2.2 MB ^[strings.txt]
• Export DotNetRuntimeDebugHeader — standard Native AOT artefact ^[strings.txt:7429]

This is the first confirmed AgentTesla sample in this corpus using Native AOT; prior confirmed samples (accd2ccd, b017d189) were conventional .NET Framework assemblies delivered via AutoItSC loaders. ^[entities/agenttesla.md]

3. Embedded Resource

The .rsrc section (entropy 7.93, 297 KB) contains a single custom BINARY resource named DLI91QTATH07DUVDLZLMHANC68RAZ — a 25-character random alphanumeric identifier consistent with the unclassified-dotnet-native-aot-loader pattern of encrypted payload staging. ^[pefile.txt:679-701] The resource is not a standard Windows resource type (no icon, manifest, or version block duplication) and its extreme entropy suggests encrypted or compressed content. Given the AgentTesla family's typical behaviour, this likely houses the SMTP C2 credentials, target configuration, or a secondary decrypted module.

4. Capability Surface (Static)

The BCL string noise obscures malicious capability strings, but several survive and align with known AgentTesla TTPs:

Notably absent from static strings: hardcoded SMTP server, username, password, or Telegram bot token. These are either inside the encrypted BINARY resource or constructed at runtime from obfuscated fragments — consistent with the unclassified-dotnet-native-aot-loader pattern.

Decompiled Behavior

Ghidra import succeeded but decompilation was hampered by the AOT runtime's aggressive inlining and massive function count. Radare2 analysis (level 3) provided a clearer surface view:

• Entry point (entry0 @ 0x14006b460): Standard Native AOT CRT startup — calls __get_initial_wide_environment, initializes the runtime, then dispatches to the managed Main equivalent. ^[r2:entry0]
• Early init (fcn.14006b58c): Sets up thread-local storage, condition variables, and exception handling frames. Calls fcn.14006b7f0 (runtime type loader init), fcn.14006cc1c (GC initialization), and fcn.14000b4f0 (likely module cctor / static constructor runner). ^[r2:fcn.14006b58c]
• No obvious reflective loader in the first ~50 functions from entry — the AOT compiler has flattened the usual Assembly.Load pattern into direct native calls.
• Import table is minimal and legitimate-looking: ADVAPI32, bcrypt, KERNEL32, ole32, plus VCRuntime forwarders. No wininet, winhttp, or ws2_32 imports — networking is handled entirely through the inlined System.Net.Http native runtime, leaving no Winsock IAT footprint. ^[pefile.txt:376-559]

C2 Infrastructure

No statically recoverable C2. The binary contains SMTP capability evidence (SmtpAccess, SmtpPermission) but no server address, port, or credential material in cleartext. The 297 KB encrypted BINARY resource (DLI91QTATH07DUVDLZLMHANC68RAZ) is the most probable container for runtime C2 configuration. Without dynamic execution or successful resource decryption, the exfiltration endpoint remains unknown.

Historical AgentTesla variants in this corpus used:

• SMTP: mail.myhydropowered.com (STARTTLS/SSL) ^[entities/agenttesla.md]
• FTP and Telegram Bot API as fallback channels
• Hardcoded UUID mutex for single-instance gating
• IP geolocation checks against api.ipify.org and ip-api.com

This sample likely follows the same channel pattern but with configuration moved into the encrypted resource.

Interesting Tidbits

• First Native AOT AgentTesla in corpus — shifts the family's tradecraft from easily reversed .NET Framework assemblies to native-compiled, analyst-hostile binaries. This significantly raises the cost of static analysis for SOC teams relying on dnSpy/ILSpy workflows.
• Authenticode signed — signed: true per rabin2. The signature may be valid, invalid, or self-signed; without certificate chain verification, its trustworthiness is unconfirmed. If valid, it would bypass SmartScreen and some EDR reputation checks. ^[rabin2-info.txt:29]
• Albanian targeting — Konfirmimi_i_porosise.exe suggests targeting of Albanian-speaking businesses or individuals, possibly in Kosovo, Albania, or diaspora communities. This is a geographic expansion beyond the usual English/Spanish/German lures observed in prior AgentTesla samples.
• Canary enabled, NX/PIC — standard modern compiler security features are present, suggesting the AOT toolchain defaults were not weakened. ^[rabin2-info.txt:6,23,27]
• No FLOSS/CAPA output — FLOSS failed with argument-parsing error; CAPA failed due to missing signatures. Both tools are less effective against Native AOT binaries. ^[floss.txt] ^[capa.txt]

How To Mess With It (Homelab Replication)

Reproducing the Native AOT build

1. Install .NET 8 SDK on a Windows or cross-compile via dotnet publish -r win-x64.
2. Create a minimal C# project with <PublishAot>true</PublishAot> and <InvariantGlobalization>true</InvariantGlobalization> (reduces size).
3. Add a Resource.resx with a BINARY entry containing random high-entropy data to simulate the encrypted payload container.
4. Build: dotnet publish -c Release -r win-x64 --self-contained
5. Observe: output PE will have no COM_DESCRIPTOR, export DotNetRuntimeDebugHeader, and contain 5,000+ BCL strings.

What you learn

• How .NET Native AOT defeats conventional .NET malware analysis pipelines
• Why EDRs relying on CLR hooking or AMSI lose visibility on AOT binaries
• How to pivot to radare2/Ghidra native workflows for .NET malware

Deployable Signatures

YARA Rule

rule AgentTesla_NativeAOT_x64 {
    meta:
        description = "AgentTesla compiled with .NET Native AOT"
        author = "PacketPursuit"
        date = "2026-06-30"
        hash = "bee6e88e6a00d3dae465fabe3c467e48b0b461c99f726505648048db9f563935"
    strings:
        $agent1 = "AgentTesla" ascii wide
        $agent2 = "AgentTesla.dll" ascii wide
        $agent3 = "AgentTesla.exe" ascii wide
        $aot1 = "DotNetRuntimeDebugHeader" ascii wide
        $aot2 = "System.Private.CoreLib" ascii wide
        $aot3 = "CanonType" ascii wide
        $aot4 = "UniversalCanonType" ascii wide
        $ver = "getEnableUnsafeUTF7EncodingUnorderedNotLessThanSignaling" ascii wide
        $smtp = "SmtpAccess" ascii wide
        $startup = "InstallStartup" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C) + 0x18) == 0x20B and
        filesize > 1MB and filesize < 5MB and
        (2 of ($agent*) or 2 of ($aot*)) and
        ($smtp or $startup)
}

Behavioral Fingerprint

This binary is a 2.2 MB x64 PE with no CLR metadata, a high-entropy (~7.9) custom BINARY resource, and imports limited to ADVAPI32, bcrypt, KERNEL32, and ole32. Upon execution, it initializes a Native AOT runtime, allocates memory via VirtualAlloc, and performs registry queries (RegOpenKeyExW) within the first 30 seconds. Network activity, if any, originates from inlined System.Net.Http code with no Winsock IAT entries. SMTP exfiltration is the expected C2 channel based on BCL string evidence.

IOC List

Detection Signatures

References

• Artifact ID: 940b5a9c-8e1c-4795-ae6a-2b4be2e1cfa5 (OpenCTI) ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• Related wiki pages:
  • agenttesla — family entity
  • dotnet-native-aot-rat-compilation — technique deep-dive
  • unclassified-dotnet-native-aot-loader — umbrella entity for AOT loaders
  • version-info-masquerade — nonsense masquerade pattern
  • social-engineering-filename-lure — procurement-themed delivery
  • smtp-exfiltration — exfiltration channel

Provenance

Analysis derived from static corpus files in raw/analyses/bee6e88e.../:

• file.txt — file(1) output
• pefile.txt — pefile Python library full PE dump
• strings.txt — GNU strings (default 4-char min)
• exiftool.json — ExifTool metadata
• rabin2-info.txt — radare2 binary header
• binwalk.txt — embedded file scan
• floss.txt — FLOSS decoded strings (failed — argument error)
• capa.txt — CAPA capability detection (failed — missing signatures)
• metadata.json — OpenCTI artifact metadata
• dynamic-analysis.md — CAPE status (skipped, no Windows guest)

Radare2 analysis performed at level 3 with 120 s timeout on pp-hermes (Lab1BU, <lan>). PyGhidra import succeeded but decompilation queries failed due to binary name suffix mismatch (-eff2c4). Native decompilation relied on radare2 pdc and pdg backends.