f6b5bdd5 — .NET Bitmap-Stego Loader (Spanish Payment Lure)

Fourth confirmed sibling of the unclassified-dotnet-bitmap-stego-loader cluster. Earliest known build timestamp (Feb 2020). Static-only — CAPE has no Windows guest for this platform. ^[dynamic-analysis.md]

1. Build / RE

Toolchain. PE32 .NET Framework 4.6 GUI assembly (CIL), compiled Thu Feb 20 20:35:50 2020 UTC. ^[rabin2-info.txt] Linker version 8.0; no debug directory, no PDB. ^[pefile.txt]

Packing / obfuscation. No external packer. Heavy random alphanumeric name mangling (namespace Pm3_psY4e5zT1G, random method names) — not ConfuserEx base64 style. Control-flow flattening inferred from flattened IL dispatchers and absence of meaningful symbol names. floss fails to decode plaintext API names due to encrypted strings. ^[floss.txt] ^[strings.txt:2033]

Embedded resources. Twenty 76×76×24 bitmap objects embedded in .rsrc (offsets 0x91951 through 0xE7405), consistent with the cluster pattern. ^[binwalk.txt] Resource streams Pm3_psY4e5zT1G.g.resources, Pm3_psY4e5zT1G.Resources.resources, and bb6f5a60e205a8.Resources.resources referenced for runtime extraction via System.Resources.ResourceReader. ^[strings.txt:3464-3465] ^[strings.txt:315]

Anti-analysis. No explicit anti-VM or anti-debug strings recovered. Capa does not flag Xen/VM detection on this sample (absence vs. first sibling may indicate evolution or capa rule variance). Entropy of .text is 7.10 — high, expected for mangled CIL. ^[pefile.txt]

Signing. Unsigned. signed: false in rabin2 header; no certificate directory. ^[rabin2-info.txt]

Version masquerade. Fabricated VS_VERSIONINFO: version 11.9.34.178, nonsense company/product strings (?==>?F>H69GCFII9A8J68?EB), internal name djfcgvjhbkjnlm;,'.'.exe. ^[exiftool.json]

Notable functions. BackgroundWorker.RunWorkerAsync / RunWorkerCompleted event wiring present for async payload staging. ^[strings.txt:2510] System.Net.Sockets and SoapHttpClientProtocol indicate network-capable secondary stage. ^[strings.txt:3507] ^[strings.txt:3839] System.Reflection.Assembly.Load + GetTypes + MethodInfo + Invoke chain confirms reflective in-memory loading. ^[strings.txt:3150] ^[strings.txt:3468] ^[capa.txt]

2. Deploy / ATT&CK

TTPs (static-only inference).

• T1620 Reflective Code Loading — Assembly.Load, GetTypes, MethodInfo, Invoke strings present; capa confirms. ^[capa.txt] ^[strings.txt:3150]
• T1027 Obfuscated Files/Information — AES + SHA256 cryptography on embedded bitmap payloads; name mangling and flattened IL. ^[capa.txt] ^[strings.txt:1695] ^[strings.txt:2637]
• T1087 Account Discovery — flagged by capa. ^[capa.txt]
• T1083 File and Directory Discovery — CreateDirectory, Exists, file extension checks. ^[capa.txt] ^[strings.txt:3773] ^[strings.txt:3509]
• T1082 System Information Discovery — get_MachineName, get_UserName, get_VirtualScreen. ^[capa.txt] ^[strings.txt:2689-2690]
• T1033 System Owner/User Discovery — flagged by capa. ^[capa.txt]

Network / C2. SoapHttpClientProtocol and System.Net.Sockets indicate the inner payload communicates over HTTP(S) SOAP or raw TCP. No hardcoded endpoint, IP, or domain recovered from static strings. ^[strings.txt:3839] ^[strings.txt:3507]

Persistence. None observable statically.

Exfil / staging. File-write and directory-creation capabilities present (write file in .NET 4×, create directory 4×). ^[capa.txt] Likely used for staging decrypted payload or log data.

Attribution. Filename copia del pago anticipado.exe is Spanish — "copy of the advance payment." Spanish-language payment/invoice social-engineering lure, consistent with the banking/fleet document themes seen in siblings (Purchase Order.exe, NEW QUOTE.exe, Bank_Payment_Advice20396.exe). No geographic or actor-specific strings recovered.

Thread control. Suspend Thread capability flagged by capa. ^[capa.txt] May be used to pause worker threads during decryption or injection.

Summary

A .NET Framework reflective loader whose malicious payload is encrypted inside ~20 small bitmap resources. The Feb 2020 build date makes this the oldest known sibling in the cluster, predating the May 2022 and Mar 2023 builds by two-plus years. Spanish payment lure, SOAP-capable inner stage, and BackgroundWorker-driven async operations are the distinguishing features of this variant.