> Family · silentnet_

~/packetpursuit $ cat /intel/families/silentnet.md

typeentityconfidencelowcreated2026-06-10updated2026-06-10malware-familyratc2zigpeloader

silentnet

A Windows PE64+ malware family first observed in the corpus as Launcher.exe (SHA-256 dbe586b5). Preliminary label from OpenCTI with no public documentation. The single analyzed sample is compiled with Zig 0.12.0, uses Zig's std.http TLS 1.3 client for C2, and decrypts XOR-obfuscated strings at runtime. The family name may be an artifact of the distributor or a false positive from OpenCTI's labeling pipeline.

Build Stack

  • Compiler: Zig 0.12.0 (LLVM/LLD backend, linker version 14.0)
  • Language: Zig (self-hosted compiler)
  • Standard library: Heavy use of std.http, std.crypto.tls, std.os.windows APIs
  • Packing: None
  • Signing: Unsigned
  • Obfuscation: XOR string decryption loops (short keys, 0x0A–0x36 bytes)
  • Anti-analysis: None observed (no VM checks, no debug checks, no stripped symbols)

Capabilities

  • zig-compiled-pe64
  • xor-obfuscated-strings
  • tls13-native-http-client
  • certificate-store-enumeration
  • registry-reconnaissance
  • host-fingerprinting
  • process-spawn-CreateProcessW
  • file-relocation-MoveFileW
  • c2-over-https
  • runtime-string-decryption

Notable Analyses

  • dbe586b5 — Zig 0.12.0 Launcher.exe, XOR-decrypted C2, TLS 1.3, registry read, child process spawn. See /intel/analyses/dbe586b56376ac96097b76ed353b6ad89977d3345774d80fce846fe97370b86f.html.

Related