unclassified-dotnet-native-aot-loader: ef48ae9e — .NET 8 AOT binary with 3.2 MB encrypted BINARY resource, "SetVersionHasValue" masquerade

Executive Summary

A 5.5 MB PE32+ x64 console binary compiled with .NET 8 Native AOT (PublishAot), carrying its entire runtime and BCL as native x64 code with zero CLR metadata. The .rsrc section contains a 3.2 MB custom-named BINARY resource (ZZERIUIN7HDZATO9A1) of near-maximum entropy (7.998), indicating a strongly encrypted or compressed embedded payload. No network IOCs, no registry persistence strings, and no credential-theft artefacts are visible statically — everything of value is sealed inside the resource blob. Static-only analysis (CAPE detonation skipped due to unavailable Windows guest).

What It Is

The binary is a textbook example of dotnet-native-aot-rat-compilation: a single-file native PE produced by ILC that embeds the entire .NET base-class library, GC, and thread pool as x64 machine code. Conventional .NET analysis tools (dnSpy, ILSpy, de4dot) fail because there is no CLR header or IL metadata to parse. ^[pefile.txt:301] ^[strings.txt:3977]

The version-info block claims the file is SetVersionHasValue.dll (product 4.91.272.31, company "SetVersionHasValue", blank copyright) — a transparent masquerade applying the version-info-masquerade pattern. ^[pefile.txt:352]

How It Works

Build Stack

• Toolchain: .NET SDK 8.0+ with <PublishAot>true</PublishAot> and RID win-x64. ^[strings.txt:3994] ^[strings.txt:3999]
• Evidence: .NETCoreApp,Version=v8.0 string, System.Private.CoreLib.dll references, Internal.Runtime.TypeLoader and RhGetGcTotalMemory runtime helpers, and CanonType / UniversalCanonType ILC artefacts scattered throughout .rdata. ^[strings.txt:3978] ^[strings.txt:4040] ^[strings.txt:5307]
• Linker: MSVC 14.40 (MajorLinkerVersion 0xE, Minor 0x28). ^[pefile.txt:66]
• Sections: .text (code), .managed (AOT metadata + JIT stubs), .rdata (readonly data including BCL strings), .data (globals), .pdata (unwind), .rsrc (resources, 3.3 MB), .reloc. ^[pefile.txt]

Embedded Payload

The .rsrc section (entropy 7.998/8.0) contains:

• PNG icon at offset 0x5354CC — 256×256 8-bit RGBA, non-interlaced. ^[binwalk.txt:7]
• Custom BINARY resource named ZZERIUIN7HDZATO9A1 at RVA 0x278250, size 0x327084 (~3.2 MB). ^[pefile.txt:696]
• App manifest XML at 0x537A97. ^[binwalk.txt:9]

The ZZERIUIN7HDZATO9A1 blob:

• Entropy: 7.9976/8.0 — indistinguishable from random; strongly encrypted or compressed. ^[manual calculation]
• No common file signatures at start (no MZ, PK, 7z, gzip, etc.). ^[manual analysis]
• No plaintext C2 URLs, IPs, domains, registry keys, or wallet strings anywhere in the blob. ^[manual string search]
• The blob is likely decrypted at runtime by the AOT-compiled stub using a key either hardcoded in .text or derived from environment/machine properties. Without dynamic execution, the decryption routine and key remain unobserved.

Imports

Minimal Win32 surface — standard AOT runtime imports only:

• ADVAPI32.dll — registry and token privilege APIs (RegOpenKeyExW, RegQueryValueExW, OpenProcessToken, AdjustTokenPrivileges). ^[pefile.txt:389]
• bcrypt.dll — BCryptOpenAlgorithmProvider, BCryptGenRandom, symmetric key generation. ^[pefile.txt:422]
• KERNEL32.dll — file I/O, process/thread, memory management, console, critical sections. ^[pefile.txt:436]
• ole32.dll — COM apartment initialization (CoInitializeEx, CoCreateGuid). ^[pefile.txt]
• CRT API sets — heap, string, math, stdio, locale. ^[pefile.txt]

No WININET, WINHTTP, WS2_32, or URLMON imports. Network functionality, if any, is implemented via the embedded BCL (System.Net.Http) compiled into the binary as native code, defeating IAT-based detection.

Decompiled Behavior

Ghidra import was queued but auto-analysis had not completed at the time of this report. Native AOT binaries of this size (>5 MB of inlined BCL) produce tens of thousands of functions with mangled compiler-generated names (e.g., <SendAsync>d__, RhGetRuntimeHelperForType). Manual decompilation of the entry-point stub (0x1400068E38) is feasible; the bulk of BCL noise is not analytically productive. The relevant logic — resource extraction, decryption, and payload execution — lives in user-compiled methods interleaved with runtime helpers. Dynamic detonation (CAPE) would be required to reliably locate and trace the payload-decryption routine.

C2 Infrastructure

No observable C2 infrastructure statically. All network-related strings, if they exist, are encrypted inside the ZZERIUIN7HDZATO9A1 resource blob. The binary uses System.Net.Http (compiled natively) for any outbound communication, so there are no traditional Winsock imports to pivot from.

• Domains / IPs: None recovered.
• URLs: None recovered.
• Mutex / Named pipes: None observed in strings.
• Registry persistence: No persistence strings (Run keys, Scheduled Tasks, Services) found in plaintext.

Conclusion: C2 configuration is runtime-resolved and encrypted, requiring dynamic analysis or successful payload extraction to characterize.

Interesting Tidbits

• The SetVersionHasValue masquerade is unusually generic — it reads like an auto-generated placeholder from a build pipeline that forgot to fill in real metadata, or a deliberately bland cover name. ^[pefile.txt:352]
• The BINARY resource type with a gibberish name (ZZERIUIN7HDZATO9A1) is a deliberate deviation from the more common RT_RCDATA (type 10) used by .NET malware for embedded configs. This may be an attempt to evade resource-type heuristics. ^[pefile.txt:696]
• The hydrated section (0x5D8C8 bytes, uninitialized) is notable — in Native AOT this often maps static writable data for the runtime. Its presence and size are consistent with a large AOT runtime image. ^[pefile.txt:139]
• Absence of any anti-debug or anti-VM strings in the BCL noise suggests the author relied on the AOT compilation itself as the primary anti-analysis measure, rather than adding custom sandbox gates.
• Compilation date of July 2024 places this roughly contemporary with the fbc07658 ValleyRAT Native AOT variant, but without payload decryption there is no proven sibling link.

How To Mess With It (Homelab Replication)

1. Toolchain: Install .NET 8 SDK.
2. Project file (Emulator.csproj):

   <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
       <OutputType>Exe</OutputType>
       <TargetFramework>net8.0</TargetFramework>
       <PublishAot>true</PublishAot>
       <RuntimeIdentifier>win-x64</RuntimeIdentifier>
     </PropertyGroup>
   </Project>
   

3. Add a custom resource in the .csproj:

   <ItemGroup>
     <EmbeddedResource Include="payload.bin" LogicalName="ZZERIUIN7HDZATO9A1" />
   </ItemGroup>
   

4. Publish:

   dotnet publish -c Release -r win-x64 --self-contained
   

5. Verification: Run diec or rabin2 -I on the output. Expect: PE32+, no COM_DESCRIPTOR, export DotNetRuntimeDebugHeader, strings for System.Private.CoreLib and Internal.Runtime.TypeLoader.
6. What you learn: How Native AOT strips CLR metadata, inflates binary size by ~5 MB, and lets you ship encrypted resources that are invisible to IAT-based sandboxes.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNetNativeAOTLoader {
    meta:
        description = "Detects .NET Native AOT compiled binaries with large encrypted resource payload"
        author = "PacketPursuit"
        date = "2026-06-19"
        sha256 = "ef48ae9e7d023988cbd22d397f59faa9393148e2ff6838fa9f9545617903170a"
    strings:
        $a = "System.Private.CoreLib" ascii wide
        $b = "Internal.Runtime.TypeLoader" ascii wide
        $c = "DotNetRuntimeDebugHeader" ascii
        $d = "PublishAot" ascii
        $e = "SetVersionHasValue" ascii wide
        $f = "ZZERIUIN7HDZATO9A1" ascii wide
        $g = "BCryptOpenAlgorithmProvider" ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_signatures == 0 and
        pe.exports("DotNetRuntimeDebugHeader") and
        pe.data_directories[pe.COM_DESCRIPTOR_DIRECTORY].virtual_address == 0 and
        (3 of ($a,$b,$c,$d,$g) or $e or $f) and
        filesize > 4000000
}

Behavioral Hunt Query (Sigma/YAML)

 title: .NET Native AOT Binary Execution with Large Resource
 logsource:
   product: windows
   category: process_creation
detection:
   selection:
     CommandLine|contains: 'PO147222D'
   selection_resource:
     - ImageLoaded|endswith: 'SetVersionHasValue.dll'
   selection_entropy:
     - Hashes|contains: 'ef48ae9e7d023988cbd22d397f59faa9393148e2ff6838fa9f9545617903170a'
   condition: selection or selection_resource or selection_entropy

IOC List

Behavioral Fingerprint

This binary is a self-contained .NET Native AOT executable (>=4 MB) with no COM_DESCRIPTOR directory, exporting DotNetRuntimeDebugHeader, and carrying a large .rsrc section (>3 MB) containing a custom-named BINARY resource of extremely high entropy. At execution, it initializes a native AOT runtime, likely decrypts the embedded resource in-memory, and transfers control to the decrypted payload without writing to disk. Network communications, if present, are performed through natively compiled System.Net.Http internals and do not appear in the import table.

Detection Signatures / ATT&CK Mapping

References

• SHA-256: ef48ae9e7d023988cbd22d397f59faa9393148e2ff6838fa9f9545617903170a
• Artifact ID: 4f7b558f-b9d4-4204-a747-d53803ea7900
• MalwareBazaar: submitted via mb-fetch.py pipeline
• Wiki pages: unclassified-dotnet-native-aot-loader, dotnet-native-aot-rat-compilation, version-info-masquerade

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt — static triage pipeline (triage-fast, 2026-05-26).
• rsrc_blob_ZZERIUIN7HDZATO9A1.bin — manually extracted from RVA 0x278250, size 0x327084.
• Entropy and magic-signature analysis performed with Python (math, collections.Counter).
• capa.txt — capa v9.0.0 (signature path missing; no result).
• floss.txt — flare-floss v3.1.0 (failed with CLI argument error).
• No dynamic analysis available (CAPE skipped — no Windows guest).