unclassified-dotnet-bitmap-stego-loader: f230118d — engineering PO lure with AES+Deflate bitmap payload chain

Executive Summary

Fifth confirmed sibling in the .NET bitmap-stego loader cluster. PE32 GUI assembly (~682 KB) distributed as Drawing_specification_and_August_PO_#07329.exe — an engineering procurement lure. Shares the cluster's hallmark of embedded bitmap payload carriers and reflective assembly loading, but carries only 16 bitmaps (vs 20–24 in prior siblings) at 88×88×24 resolution (vs 76×76×24). New delta: explicit DeflateStream and System.IO.Compression strings alongside CryptoStream / CreateDecryptor, suggesting the inner payload is AES-decrypted then Deflate-decompressed before reflective loading. SoapHttpClientProtocol present, implying SOAP-over-HTTP C2 in the decrypted stage. Static-only — CAPE skipped (no Windows guest).

What It Is

Family ascription: Confirmed sibling of unclassified-dotnet-bitmap-stego-loader. Same randomized-name-mangling style, same System.Resources.ResourceReader / System.Drawing.Bitmap resource extraction pattern, same capa fingerprint (load .NET assembly, access .NET resource, decrypt data using AES via .NET). The delta is the smaller bitmap count (16), larger bitmap dimensions (88×88×24), the presence of DeflateStream / System.IO.Compression, and a lower version number (2.4.5.6 vs 11.9.34.178–24.11.37.197). The short internal name filr.exe is almost readable (file-r?), a notable departure from the gibberish names of prior siblings.

How It Works

Shared behavior is documented at unclassified-dotnet-bitmap-stego-loader; this section covers deltas only.

Bitmap payload carriers: binwalk identifies 16 PC bitmap structures (88×88×24) beginning at offset 0x46103, spaced ~23 KB apart through the .text overlay. ^[binwalk.txt] This is fewer and larger than the 20–24 bitmaps at 76×76×24 seen in siblings 4bf14434, db0d6bc0, f74d8a51, and f6b5bdd5. The pixel arrays likely carry encrypted ciphertext; the dimension change may accommodate a larger inner payload or a different builder template.

Resource extraction: System.Resources.ResourceReader, RuntimeResourceSet, GetManifestResourceStream, and GetManifestResourceNames strings confirm runtime enumeration of embedded resources. ^[strings.txt:9] ^[strings.txt:1085] ^[strings.txt:1151]

Decryption chain (new delta): This sample adds DeflateStream, System.IO.Compression, CryptoStream, MemoryStream, ICryptoTransform, and CreateDecryptor to the string table. ^[strings.txt:1086-1100] ^[strings.txt:1094] ^[strings.txt:1136] Prior siblings showed AES/SHA256/PRNG but did not surface explicit DeflateStream. The likely pipeline is: (1) extract bitmap pixel bytes, (2) AES-decrypt via CreateDecryptor into a CryptoStream, (3) pipe through DeflateStream for decompression, (4) load the resulting .NET assembly via Assembly.Load(byte[]).

Reflective loading: Assembly.Load, GetMethods, GetExportedTypes, Invoke, BeginInvoke, EndInvoke, and add_AssemblyResolve strings support capa's T1620 hit. ^[capa.txt] ^[strings.txt:993-994] ^[strings.txt:1152] ^[strings.txt:1140]

Network hint: SoapHttpClientProtocol string present, implying SOAP-over-HTTP C2 in the decrypted stage. ^[strings.txt:1223] Same hint seen in siblings f6b5bdd5 and f74d8a51; no endpoint URL recovered statically.

PRNG use: generate random numbers in .NET (2 matches) and Random string present. ^[capa.txt] ^[strings.txt:1093] Likely used for key derivation, IV generation, or sandbox evasion.

Anti-VM: Capa flags reference anti-VM strings targeting Xen. ^[capa.txt]

No WinForms UI depth: Unlike f74d8a51 (fleet-maintenance GUI masquerade), this sample has minimal UI strings — only System.Windows.Forms.Form, My.Forms, and My.MyProject.Forms. ^[strings.txt:1217-1219] ^[strings.txt:1155] The lure is carried entirely by the filename, not a functional GUI shell.

Decompiled Behavior

Radare2 analysis (level 2) recovered 882 CIL functions. ^[r2:analysis] The export table is flooded with randomized alphanumeric identifiers typical of this cluster:

• c7BEp8.Ad4e0L.Mi9m6B
• Gw8d1Q.Rk35Tq.Yi04At
• g1QFz9.Nd47Rf.z0Z4Tb
• x6.Gp.Cw3k1G (longer mangled names appear in later offsets) ^[r2:exports]

No human-readable method names recovered. CIL stack-machine pseudocode is not meaningful for behavioral narrative without ILSpy-level decompilation. Key behavioral evidence therefore derives from string extraction and capa capability detection.

Notable strings confirming capa-claimed behaviors:

• GetManifestResourceStream ^[strings.txt:1085]
• CreateDecryptor ^[strings.txt:1136]
• DeflateStream / System.IO.Compression ^[strings.txt:1086] ^[strings.txt:1100]
• CryptoStream / MemoryStream / ICryptoTransform ^[strings.txt:1087-1088] ^[strings.txt:1094]
• Invoke / BeginInvoke / EndInvoke ^[strings.txt:993-994]
• SoapHttpClientProtocol ^[strings.txt:1223]

C2 Infrastructure

No hardcoded IOCs recovered statically. All network logic is expected to reside inside the bitmap-encrypted inner payload. The only network hint is SoapHttpClientProtocol, implying SOAP-over-HTTP C2 once decrypted. No domains, IPs, ports, mutex names, or bot tokens present in strings. ^[strings.txt]

Interesting Tidbits

• Smallest sibling: At 682 KB, this is the smallest confirmed cluster member (prior range: 927 KB–984 KB). The reduced size correlates with fewer bitmaps (16 vs 20–24). ^[file.txt]
• Dimension shift: 88×88×24 bitmaps vs 76×76×24 in all four prior siblings. May indicate a different builder template or payload size requirement. ^[binwalk.txt]
• Readable internal name: filr.exe is almost legible as "file-r" — unusual in a cluster whose internal names are typically gibberish (djfcgvjhbkjnlm;,'.'.exe, KKKKK.exe, NEW QUOTE.exe). Could be a slip or an intentional near-masquerade. ^[exiftool.json]
• Deflate addition: First sibling to surface DeflateStream and System.IO.Compression explicitly. This suggests the builder or the inner payload author added a compression layer after AES decryption. ^[strings.txt]
• Version numbering: 2.4.5.6 is far below the 11.x–24.x range of prior siblings, but the AssemblyVersion is 1.0.0.0 — a default .NET project template value, possibly indicating a fresh build environment or new operator. ^[exiftool.json]
• Resource module names: s6S.g.resources, a5524d94baa6b1.Resources.resources, s6S.Resources.resources — same mangled namespace pattern as prior siblings. ^[strings.txt:1147-1149]

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019+ targeting .NET Framework 4.6–4.8, C# WinForms.

Recipe:

1. Create a C# WinForms project. Add 16 BMP files (88×88×24) as Embedded Resource.
2. Encrypt a second-stage .NET assembly (e.g., a simple SOAP HTTP beacon) with AES-256-CBC.
3. Compress the ciphertext with Deflate (System.IO.Compression.DeflateStream).
4. Embed the compressed ciphertext across the bitmap pixel arrays.
5. At runtime: load bitmaps via GetManifestResourceStream, extract pixel bytes, AES-decrypt with a hardcoded or PRNG-derived key, then Deflate-decompress.
6. Load the decrypted assembly with Assembly.Load(byte[]) and invoke entry point via MethodInfo.Invoke.
7. Obfuscate with a .NET obfuscator supporting name mangling and control-flow flattening.

Verification: Run capa on the reproducer. Expected hits: load .NET assembly, invoke .NET assembly method, access .NET resource, decrypt data using AES via .NET, generate random numbers in .NET, reference anti-VM strings targeting Xen, plus System.IO.Compression / DeflateStream strings in the static view.

What you'll learn: How adding a Deflate layer after AES changes the static string fingerprint and what capa still surfaces despite obfuscation.

Deployable Signatures

YARA Rule

rule dotnet_bitmap_stego_loader_f230118d {
    meta:
        description = ".NET bitmap-stego loader cluster — 88x88 bitmap payload carriers, AES+Deflate decryption chain"
        author = "pp-hermes"
        date = "2026-06-19"
        hash1 = "f230118d14a393bc3af4ff150e719f215a2fe7a024734de1c44ce12b987a7706"
        hash2 = "4bf14434ef61c6da79d3e5e4ea7831a4e5f0a2769cccdb41ddcc7ca0920e640a"
        hash3 = "db0d6bc0d73b6e2cf8dedde102e67ab2ad6233c9ff93f29be39351c1580dec8f"
    strings:
        $bmp_type = "System.Drawing.Bitmap" wide ascii
        $res_reader = "System.Resources.ResourceReader" wide ascii
        $runtime_res = "System.Resources.RuntimeResourceSet" wide ascii
        $manifest = "GetManifestResourceStream" wide ascii
        $asm_load = "Assembly.Load" wide ascii
        $invoke = "Invoke" wide ascii
        $aes = "CreateDecryptor" wide ascii
        $deflate = "DeflateStream" wide ascii
        $compression = "System.IO.Compression" wide ascii
        $soap = "SoapHttpClientProtocol" wide ascii
        $bitmap_magic = { 42 4D }  // BM bitmap header
    condition:
        uint16(0) == 0x5A4D and
        ($bmp_type and $res_reader and $runtime_res) and
        ($manifest or $asm_load or $invoke) and
        ($aes or $bitmap_magic) and
        filesize > 500KB and filesize < 2MB
}

Behavioral Hunt Query (Sigma-like pseudocode)

title: .NET Bitmap-Stego Loader Runtime Behavior — AES+Deflate Variant
logsource:
  category: process_creation
detection:
  selection_image:
    Image|endswith: '.exe'
  selection_resources:
    CommandLine|contains:
      - 'System.Drawing.Bitmap'
      - 'GetManifestResourceStream'
  selection_crypto:
    CommandLine|contains:
      - 'CryptoStream'
      - 'DeflateStream'
      - 'CreateDecryptor'
  selection_load:
    CommandLine|contains:
      - 'Assembly.Load'
      - 'Invoke'
  condition: selection_image and (selection_resources and selection_crypto and selection_load)

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework GUI executable that enumerates ~16 embedded System.Drawing.Bitmap resources (88×88×24) from its .rsrc section shortly after launch, extracts pixel-level data, decrypts the payload using AES via CreateDecryptor inside a CryptoStream, then pipes the result through DeflateStream (System.IO.Compression) to recover a second-stage .NET assembly, which is loaded reflectively via Assembly.Load / MethodInfo.Invoke. The outer binary masquerades as an engineering drawing / purchase-order document (Drawing_specification_and_August_PO_#07329.exe) with minimal GUI depth. Capa detects anti-VM Xen strings. No hardcoded C2 endpoints are visible statically; network communication is inferred to be SOAP-over-HTTP based on a SoapHttpClientProtocol runtime reference.

Detection Signatures

References

• Artifact ID: 3af5941c-3768-4112-b466-97bd136256db (OpenCTI / MalwareBazaar)
• Family entity: unclassified-dotnet-bitmap-stego-loader
• Related concept: dotnet-manifest-resource-decryption
• Sibling analyses: 4bf14434 (Apr 2020), db0d6bc0 (May 2022), f74d8a51 (Mar 2023), f6b5bdd5 (Feb 2020)

Provenance

Static analysis performed 2026-06-19 on pp-hermes. Tools: file 5.44, exiftool 12.76, pefile Python module, strings GNU binutils, flare-floss (malformed args — no decoded output), flare-capa 7.x, binwalk 2.3.3, radare2 5.x (level-2 analysis, 882 CIL functions), ssdeep 2.14.1, tlsh 4.x. CAPE sandbox skipped — no Windows guest available. No dynamic execution data.