unclassified-dotnet-bitmap-stego-loader: f31920ba — Bank masquerade, mixed-format image carriers

Executive Summary

Eighth confirmed sibling in the .NET Bitmap-Stego Loader cluster. Deviates from all prior siblings by using only 4 image carriers (3 PNG + 1 BMP) at much larger dimensions (256×256 RGBA, 513×513 RGBA, 129×128×32 BMP) instead of the cluster's typical ~20 small 76×76 BMPs. Adopts a banking/purchase-order GUI masquerade (Order_PI.exe, Bank product name, IBAN/CNP/TransferBL type names). Static-only analysis (CAPE skipped — no Windows guest). No C2 IOCs recovered statically; payload decryption key and final stage remain unknown.

What It Is

Internal name vdfj.exe, version 1.0.0.0, VS_VERSIONINFO FileDescription/ProductName Bank, Copyright 2016. ^[exiftool.json:38-43] ^[pefile.txt:236-243] PDB path vdfj.pdb. ^[rabin2-info.txt:13] ^[pefile.txt:352]

Build / RE

Toolchain: .NET Framework 4.x C# compiled to CIL/PE32. VS_VERSIONINFO LangID 000004b0 (neutral). GUID 5F030CD6-DCCD-4BAD-B160-B1990D59592C. ^[pefile.txt:217-220] ^[pefile.txt:344-353] No Authenticode, no strong-name.

Packing / Obfuscation: None of the traditional sort. No UPX, no ConfuserEx resource names, no ObfuscatedBy strings. Light name mangling is present (sAPt for the resource getter, Bank.LogIn._GClr / _AClrData / _PBmp / _PixProcess for the extraction machinery) but the type namespace (Bank, BankBLL, BankDAL) and method bodies are otherwise unobfuscated. .text entropy 7.84 — high, consistent with embedded encrypted payload data. ^[pefile.txt:92]

Anti-analysis: None observed. No IsDebuggerPresent, CheckRemoteDebuggerPresent, VM-check, or sandbox-gate strings. Unlike sibling 4bf14434 (Xen anti-VM) and d4d106f8 (none), this sample is the simplest cluster member to date. capa flags only reference analysis tools strings (anti-analysis namespace), not a concrete check. ^[capa.txt:28]

Embedded resources / carriers: Four image files embedded in the binary body, not in .rsrc:

• PNG 256×256 RGBA at offset 0x8A5F (35 423) ^[binwalk.txt:6]
• PNG 256×256 RGBA at offset 0x9848 (38 984) ^[binwalk.txt:8]
• BMP 129×128×32 at offset 0xA348 (41 800) ^[binwalk.txt:10]
• PNG 513×513 RGBA at offset 0x1A757 (108 375) ^[binwalk.txt:11]

The .rsrc section is stripped to RT_VERSION (VS_VERSIONINFO) + RT_MANIFEST (UAC asInvoker) only — no bitmap resources. ^[pefile.txt:257-329] This is the same .rsrc-stripped pattern as sibling d4d106f8, confirming a builder evolution to evade resource-directory scanners.

Notable functions:

• Bank.Properties.Resources.get_sAPt — obfuscated resource accessor that returns the stashed payload stream. ^[strings.txt:304] ^[r2:method.Bank.Properties.Resources.get_sAPt]
• Bank.LogIn._GClr — GetPixel wrapper (reads individual pixel colors). ^[r2:method.Bank.LogIn._GClr]
• Bank.LogIn._AClrData — alpha/color channel data extraction routine. ^[r2:method.Bank.LogIn._AClrData]
• Bank.LogIn._PBmp / _PixProcess / _ProcessYCoords / _GetBmpHeight — bitmap traversal and pixel-extraction orchestration. ^[r2:function-list]

These method names are not random alphanumeric (as in 4bf14434 and db0d6bc0) but semantically meaningful within the obfuscation scheme: GClr = get color, AClrData = alpha/color data, PBmp = process bitmap.

Deploy / ATT&CK

T1620 Reflective Code Loading — invoke .NET assembly method and access .NET resource from capa; the extraction chain decrypts pixel data into a byte array and feeds it to Assembly.Load or equivalent. ^[capa.txt:32] ^[capa.txt:30]

T1614 System Location Discovery — get geographical location flagged by capa. ^[capa.txt:29] No static evidence of the specific mechanism (no GetLocaleInfo / GetUserGeoID strings), but the capability namespace is triggered.

T1036.002 Masquerading — Fake bank application with purchase-order filename (Order_PI.exe), banking UI strings (BankBLL, BankDAL, IBAN, CNP, TransferBL, MakeTransfer, EmployeeData, AccountBL), and fabricated 2016 copyright. ^[strings.txt:26-242] ^[exiftool.json:38-43]

No persistence — No Registry Run, services, scheduled tasks, or startup folder strings observed statically.

No C2 infrastructure — No IPs, domains, URLs, mutexes, or named pipes in static strings. System.Net.Http is absent (unlike sibling d4d106f8). The network capability, if any, lives inside the encrypted bitmap payload. SoapHttpClientProtocol is also absent (dropped in d4d106f8 and this sample).

Static-only — CAPE skipped; no Windows guest available. ^[dynamic-analysis.md:3]

Cluster Comparison

This sample represents the most aggressive reduction in carrier count and the largest carrier dimensions in the cluster. The builder is clearly iterating: fewer, larger images → less binwalk/entropy noise, more payload capacity per image, and continued evasion of .rsrc-based signatures.

How To Mess With It (Homelab Replication)

1. Build a C# WinForms .NET Framework 4.x app with a fake bank UI (labels for IBAN, CNP, transfer buttons).
2. Embed 3–4 large PNG/BMP files (256×256 or larger) as raw byte arrays in the .text section or as EmbeddedResource.
3. Implement _GClr / _AClrData / _PixProcess methods that iterate pixels, extract RGBA bytes, and write to a MemoryStream.
4. Decrypt the stream (XOR or AES — the key is not recoverable statically) and Assembly.Load the result.
5. Strip .rsrc of all bitmap entries; keep only RT_VERSION and RT_MANIFEST.

Verification: capa should hit compiled to the .NET platform, access .NET resource, invoke .NET assembly method. binwalk should surface PNG image and PC bitmap structures.

Deployable Signatures

YARA Rule

rule UnclassifiedDotNetBitmapStegoLoader_BankVariant_2024
{
    meta:
        description = ".NET Bitmap-Stego Loader bank variant (f31920ba) — mixed PNG+BMP carriers, .text embedding"
        author      = "PacketPursuit"
        date        = "2026-07-22"
        sha256      = "f31920ba7bb3d9a49382e06cfe13eddee4c4375cacd93c74794f1c7ec342c707"
        family      = "unclassified-dotnet-bitmap-stego-loader"
    strings:
        $dotnet1 = "System.Resources.ResourceReader" ascii wide
        $dotnet2 = "System.Drawing.Bitmap" ascii wide
        $dotnet3 = "Bank.Properties.Resources" ascii wide
        $res_get = "get_sAPt" ascii wide
        $func1    = "_GClr" ascii wide
        $func2    = "_AClrData" ascii wide
        $func3    = "_PixProcess" ascii wide
        $func4    = "_ProcessYCoords" ascii wide
        $bank1    = "BankBLL" ascii wide
        $bank2    = "TransferBL" ascii wide
        $bank3    = "IBAN" ascii wide
        $pdb      = "vdfj.pdb" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        $dotnet1 and
        ($dotnet2 or $dotnet3) and
        ($res_get or $func1 or $func2) and
        ($bank1 or $bank2 or $bank3)
}

Attribution & Confidence

• Family: unclassified-dotnet-bitmap-stego-loader — high-confidence sibling (n=8). Same build pattern, same bitmap-steganography technique, same reflective-loading chain, same .rsrc-stripped or .text-embedded carrier placement.
• Attribution: Unknown actor / builder kit. No linguistic clues beyond English GUI strings. Code reuse across 8 samples spanning 2020–2024 suggests a sustained operator or a shared builder sold/reused in multiple campaigns.
• Confidence: High for family placement; low for actor attribution.