ce07d963 — .NET x64 reflective loader masquerading as "Strong" utility

Build / RE

Language / Runtime: C# .NET Framework, 64-bit PE32+ (AMD64). PE compilation timestamp 2024-10-08 13:58:44 UTC ^[file.txt]. Version info claims Strong.exe / Strong / 1.0.0.0 / Copyright 2024 — likely a masquerade to look like a legitimate tool or game mod ^[file.txt:20-32]. No PDB path recovered; the sample was built without debug symbols.

Compiler: csc / Roslyn (evidenced by mscorlib binding and Microsoft.CodeAnalysis.EmbeddedAttribute patterns in metadata) ^[capa.txt].

Packing / Obfuscation: No native packer. The binary remains a valid .NET assembly with a 2-section PE layout (.text, .rsrc) ^[file.txt]. Heavy IL-level obfuscation is present: radare2 exports show mangled Unicode surrogate names (\u06a1\ufc35... etc.) and 20-char random strings, consistent with ConfuserEx or a similar .NET obfuscator ^[r2:exports]. capa flags compiled to the .NET platform and invoke .NET assembly method ^[capa.txt].

Anti-analysis: No VM checks, no anti-debug strings, and no TLS callbacks observed in static analysis. The primary defense is heavy name mangling and probable control-flow flattening (typical of the obfuscator family), not environmental gating. FreeConsole is absent from strings, suggesting the sample may keep a visible console or was compiled as a console app (capa reports accept command line arguments) ^[capa.txt].

Embedded resources: .NET resource stream present in .rsrc (0x3E00 bytes) but contents are not decrypted in the static artifact set. Given the AES + GZip + Base64 patterns observed in the string table, the payload is likely staged inside this resource and decrypted at runtime ^[floss.txt] (floss invocation errored; static strings alone are insufficient).

Notable imports / API usage: System.Security.Cryptography.AesManaged, CreateDecryptor, ICryptoTransform, GZipStream, Convert.FromBase64String, Assembly.Load, MethodInfo.Invoke, Marshal.GetDelegateForFunctionPointer, GetProcAddress, FreeConsole (not found in this sample, but other P/Invoke patterns present), Random ^[strings.txt]. The GetProcAddress + GetModuleHandle P/Invoke pair indicates runtime API resolution for native bridging.

Code quality: Relatively high for commodity malware — clean .NET metadata, valid assembly version, and a deliberate masquerade suggest a purchased or pre-built crypter/loader rather than a one-off manual build.

Deploy / ATT&CK

C2 / Network: No hardcoded IPs, URLs, or domain strings found in static analysis. C2 configuration is likely inside the encrypted resource payload or delivered via a secondary stage (no network artifact to inspect). The UriSchemeHttp and CheckHostName strings suggest HTTP-capable C2, but no target endpoints are visible statically ^[strings.txt].

Persistence: None observed statically. No registry, scheduled task, or startup-folder strings present. Persistence would be handled by the decrypted payload, not this outer loader.

Attribution: None. The "Strong" branding and 2024 copyright are generic masquerade. No linguistic markers, no code overlap with known families, and no reused PDB paths. The build tooling (csc + obfuscator) is commodity.

Dynamic Analysis

Status: No CAPE detonation available. No Windows guest currently provisioned. All behavioral observations are static inference marked above. The outer loader decrypts a resource into a managed or unmanaged buffer and then invokes it; the actual C2, persistence, and payload behavior are opaque without runtime detonation.

Summary

A commodity .NET 64-bit reflective loader/crypter with a masquerade identity ("Strong" utility). Outer layer uses AES + GZip + Base64 to unpack a staged payload from the .rsrc section, then bridges into native code via P/Invoke and MethodInfo.Invoke. No environmental gating; relies on obfuscation and name mangling for evasion. Inner payload unknown due to lack of dynamic execution. Treat as a stage-1 dropper/loader until detonation confirms stage-2 behavior.