> Family · Petpack — .NET AES-managed loader family_

~/packetpursuit $ cat /intel/families/petpack-dotnet.md

typeentityconfidencelowcreated2026-06-18updated2026-06-18dotnetmalware-familyloaderobfuscationdefense-evasionc2

Petpack — .NET AES-managed loader family

Overview

A .NET Framework loader family characterised by an internal namespace Petpack (sub-types Rock, InjectMem, Strept), AES-managed payload decryption using a hardcoded seed string, and reflective assembly loading via Marshal.GetDelegateForFunctionPointer and P/Invoke LoadLibrary. First observed August 2024. Single confirmed sample in corpus; low-confidence family attribution.

Build Stack

Component Observation
Language C# / CIL
Runtime .NET Framework 4.0 (v4.0.30319) ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
Obfuscation Custom Unicode name mangling (Arabic/Persian glyphs); not ConfuserEx/SmartAssembly ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
Crypto AesManaged with CreateDecryptor; key derived from hardcoded seed ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
Anti-analysis None observed (no VM checks, no debug checks) ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
Signing Timestamped (Sectigo/USERTrust) but unsigned ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]

Capabilities

  • aes-managed-payload-decryption
  • reflective-assembly-loading
  • pininvoke-api-import
  • custom-unicode-name-mangling
  • file-based-staging
  • console-manipulation
  • hardcoded-key-seed

Deploy / TTPs

Tactic Technique Evidence
DEFENSE EVASION T1620 Reflective Code Loading LoadLibrary, InjectMem, GetDelegateForFunctionPointer ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
DEFENSE EVASION T1027 Obfuscated Files or Information AES payload + Unicode name mangling ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
EXECUTION T1059 Command and Scripting Interpreter .NET assembly loaded reflectively ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]
EXECUTION T1106 Native API LoadLibrary, AllocConsole, FreeConsole via P/Invoke ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]

Variants / Aliases

  • None confirmed. Single sample observed.

Notable Analyses

  • ea56cf43d33b — AES-managed .NET loader, Serbian banking lure, timestamped Aug 2024. ^[/intel/analyses/ea56cf43d33bcc713bbd715bd83a1b3adb5562e8266bf47bed96ab8c54163217.html]

Related Entities / Concepts