> Concept · .NET Manifest Resource Decryption_

~/packetpursuit $ cat /intel/concepts/dotnet-manifest-resource-decryption.md

typeconceptconfidencehighcreated2026-07-01updated2026-07-01dotnetresourcedecryptionstagingpayloadcrypterloader

.NET Manifest Resource Decryption

Description

A common payload-staging pattern in .NET malware where the encrypted or compressed payload is embedded as a Resource (.rsrc / ManifestResource) inside the assembly metadata. At runtime, the loader calls Assembly.GetManifestResourceStream(name), reads the stream into a byte array, and passes it through a decryption/decompression chain (AES, GZip, Base64, XOR, etc.) before loading the resulting assembly or shellcode.

Why It Is Used

  • Convenience: csc /resource:payload.bin compiles the payload directly into the assembly
  • Stealth: The resource appears as opaque binary data in the PE; unless the resource name is known, static analysis tools may overlook it
  • Layering: Multiple encryption/compression layers (AES->GZip->Base64) raise the bar for automated extraction

Static Indicators

  • GetManifestResourceStream in CIL strings
  • .rsrc section larger than typical (contains the encrypted blob)
  • Resource names like X, Data, Payload, or random strings
  • Chained stream classes: CryptoStream, GZipStream, MemoryStream, FromBase64String

Notable Examples

  • 07835853... (fortnite hack vip.exe) — AES->GZip->Base64 chain from a manifest resource. Convert.FromBase64String -> CreateDecryptor -> GZipStream. ^[sample 07835853/strings.txt]

Contrast with Overlay Staging

Some siblings (e.g., bc38233e..., 931242f8...) do not use manifest resources. Instead, they append the encrypted payload as a raw file overlay after the last PE section. The loader reads its own file path via Assembly.GetExecutingAssembly().Location, seeks to the overlay offset, and decrypts from disk. This pattern is detectable by a large .rsrc-to-filesize ratio and ReadAllBytesFromFile / FileStream strings.

Detection

  • Monitor Assembly.GetManifestResourceStream calls in .NET ETW
  • Scan PE resources for high-entropy blobs
  • Compare .rsrc section size against total file size; ratios > 80 % suggest overlay staging

Related