> Family · Unclassified .NET Bitmap-Stego Loader_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-bitmap-stego-loader.md

typeentityconfidencelowcreated2026-06-05updated2026-07-22dotnetobfuscationloaderbitmap-steganographyunclassified

Unclassified .NET Bitmap-Stego Loader

Umbrella label for a .NET Framework PE32 loader family characterized by embedding ~20 small bitmap resources (typically 76×76×24) that serve as encrypted payload or config carriers. Static analysis shows heavy name mangling, control-flow flattening, and System.Resources.ResourceReader stream extraction, but the final decrypted payload is not recoverable without dynamic execution.

Build / RE

  • Format: PE32 (GUI) .NET assembly, minimal IAT (mscoree.dll!_CorExeMain only). ^[sample 4bf14434/pefile.txt]
  • Obfuscation: Random alphanumeric name mangling (not ConfuserEx base64), flattened IL dispatchers, encrypted strings. floss yields no plaintext API names. ^[sample 4bf14434/floss.txt]
  • Resources: Repeated System.Drawing.Bitmap objects referenced in strings; binwalk confirms 20+ PC bitmap structures in .rsrc. ^[sample 4bf14434/binwalk.txt]
  • Masquerade: Fabricated VS_VERSIONINFO with nonsense company/product names and version 21.19.1.278. ^[sample 4bf14434/exiftool.json]

Deploy / ATT&CK

  • T1620 Reflective Code Loading — Assembly.Load / GetMethod / Invoke strings present; capa confirms. ^[sample 4bf14434/capa.txt]
  • T1497.001 Virtualization/Sandbox Evasion — Anti-VM Xen strings detected by capa. ^[sample 4bf14434/capa.txt]
  • T1083 File and Directory Discovery — File existence/extension checks flagged by capa. ^[sample 4bf14434/capa.txt]
  • T1036.002 Masquerading — Fake version-info block. ^[sample 4bf14434/exiftool.json]

Capabilities

  • dotnet-manifest-resource-decryption
  • bitmap-embedded-payload-steganography
  • name-mangling-obfuscation
  • control-flow-flattening
  • version-info-masquerade
  • reflective-assembly-loading
  • anti-vm-xen-detection
  • aes-deflate-stream-decryption-chain
  • soap-http-client-protocol-reference
  • bank-gui-masquerade-iban-cnp-transfer
  • mixed-format-png-bmp-carriers
  • pixel-extraction-rgba-channels

Related

Notable Analyses

  • db0d6bc0 (May 2022) — Second confirmed sibling. Version 24.11.37.197, internal name KKKKK.exe, filename Purchase Order.exe, ~24 embedded bitmaps. Same build pattern, same obfuscation style. Static-only analysis. ^[/intel/analyses/db0d6bc0d73b6e2cf8dedde102e67ab2ad6233c9ff93f29be39351c1580dec8f.html]

  • f74d8a51 (Mar 2023) — Third confirmed sibling. Version 20.3.49.113, internal name NEW QUOTE.exe, filename NEW QUOTE.COM, ~24 embedded bitmaps, fleet-maintenance GUI masquerade with OBD2/service-record/report-generation UI, SoapHttpClientProtocol SOAP reference, SHA256 + PRNG strings. Largest sibling at 984 KB. Static-only analysis. ^[/intel/analyses/f74d8a51625a7a66a4bdd5f569221bc492f5f61d6828fe6f9546368a040a5461.html]

  • f6b5bdd5 (Feb 2020) — Fourth confirmed sibling. Version 11.9.34.178, internal name djfcgvjhbkjnlm;,'.'.exe, filename copia del pago anticipado.exe, ~20 embedded bitmaps, Spanish payment-lure social engineering, BackgroundWorker-driven async staging, SoapHttpClientProtocol + System.Net.Sockets network references. Earliest known build in cluster. Static-only analysis. ^[/intel/analyses/f6b5bdd5958eefc7f7e595ee8e91c2407193226acad0bfa939f3a1a42cf08396.html]

  • f230118d (May 2026) — Fifth confirmed sibling. Version 2.4.5.6, internal name filr.exe, filename Drawing_specification_and_August_PO_#07329.exe, 16 embedded bitmaps at 88×88×24 (fewer and larger than prior 76×76×24 siblings), explicit DeflateStream / System.IO.Compression strings suggesting AES+Deflate decryption chain, minimal GUI depth (no functional WinForms shell). Engineering-procurement lure. Static-only analysis. ^[/intel/analyses/f230118d14a393bc3af4ff150e719f215a2fe7a024734de1c44ce12b987a7706.html]

  • d4d106f8 (Jun 2026) — Sixth confirmed sibling. Version 1.1.1.1, internal name Order.exe, filename Order.exe, 8 embedded bitmaps at 136×136×24 (fewer and larger than all prior siblings), bitmaps embedded in .text section rather than .rsrc, event-registration / attendee-management GUI masquerade (RegisteredAttendees, TransferOffered, AttendeeRegistered, InjuryReported, registrationFee), System.Net.Http without SoapHttpClientProtocol, no DeflateStream / System.IO.Compression strings. Static-only analysis. ^[/intel/analyses/d4d106f84bafa58d7b26128c6c32f80ebdaa7c333fc341ed119405434dde2751.html]

| a497a066 (Feb 2020) — Seventh confirmed sibling. Version 10.21.32.8, internal name done.exe, filename vessel's_main_particulars.exe, 21 embedded bitmaps at 76×76×24 (highest bitmap count in cluster), maritime shipping-lure social engineering, RijndaelManaged + SHA256 strings, SoapHttpClientProtocol retained, no DeflateStream / System.IO.Compression. Leap-day build timestamp. Simplest AES-only decryption chain among siblings. Static-only analysis. ^[/intel/analyses/a497a066fe94fbfad7361eee98b725cc0c32be13bd0c1742d010a98c97a483d7.html]

  • f31920ba (Nov 2024) — Eighth confirmed sibling. Version 1.0.0.0, internal name vdfj.exe, filename Order_PI.exe, 4 mixed-format carriers (3 PNG 256×256 RGBA + 1 BMP 129×128×32 + 1 PNG 513×513 RGBA) in .text section (no .rsrc bitmaps), bank/purchase-order GUI masquerade (Bank, BankBLL, IBAN, CNP, TransferBL), pixel-extraction routines named _GClr / _AClrData / _PixProcess / _ProcessYCoords, no anti-VM, no SoapHttpClientProtocol, no DeflateStream / System.IO.Compression. Light obfuscation; no ConfuserEx. Static-only analysis. ^[/intel/analyses/f31920ba7bb3d9a49382e06cfe13eddee4c4375cacd93c74794f1c7ec342c707.html]

Note

No runtime C2 IOCs recovered; payload logic is ciphertext inside bitmaps. Requires detonation or manual bitmap extraction + decryption key recovery.