> Family · unclassified-dotnet-crypter-loader_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-crypter-loader.md

typeentityconfidencemediumcreated2026-06-10updated2026-07-08dotnetmalware-familyloaderobfuscationpayloadcode-injectiondefense-evasion

unclassified-dotnet-crypter-loader

Overview

A commodity .NET Framework crypter/loader family. Outer binary is a C# PE32/PE32+ that decrypts a multi-layer payload from an embedded resource or raw file overlay, then bridges into native code via P/Invoke and/or System.Reflection. The family masquerades as game hacks, cheats, or purchase-order documents to socially engineer execution. Four confirmed siblings; build stack varies between ConfuserEx-obfuscated and unobfuscated variants.

Build Stack

  • Language: C# / .NET Framework 4.0+ ^[sample 07835853/strings.txt:792]
  • Compiler: csc / Roslyn (evidenced by Microsoft.CodeAnalysis.EmbeddedAttribute) ^[sample 07835853/strings.txt:46]
  • Obfuscator: ConfuserEx or derivative (20-char random alphanumeric name mangling, high-entropy .text, reflection.emit thunks) ^[sample 07835853/capa.txt]
  • Packer: None native — remains a valid .NET assembly
  • Signing: Unsigned

Deploy / TTPs

MITRE ATT&CK Technique Evidence
T1027 Obfuscated Files or Information AES + GZip + Base64 layered encryption ^[sample 07835853/capa.txt]
T1140 Deobfuscate/Decode Files or Information Convert.FromBase64String + CreateDecryptor + GZipStream chain ^[sample 07835853/strings.txt:197-199,406,446-448]
T1560.002 Archive Collected Data::Archive via Library GZipStream decompression of payload ^[sample 07835853/capa.txt]
T1129 Shared Modules LoadLibrary + GetProcAddress P/Invoke ^[sample 07835853/strings.txt:422-425]
T1620 Reflective Code Loading DynamicMethod + ILGenerator + GetDelegateForFunctionPointer runtime thunk generation ^[sample 07835853/strings.txt:346-348,375,428]
T1055 Process Injection (inferred) nativeEntry / nativeSizeOfCode fields suggest unmanaged shellcode/DLL injection ^[sample 07835853/strings.txt:493-494]

Variants / Aliases

  • Newmcentu.exe (internal name)
  • Aflxpd.exe (secondary internal name)
  • fortnite hack vip.exe (distribution filename)

Notable Analyses

  • /intel/analyses/0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.html — Deep static analysis of SHA-256 07835853... (AES→GZip→Base64 manifest-resource decryption, ConfuserEx obfuscation, fortnite hack vip.exe masquerade)

  • /intel/analyses/bc38233e18628256407420a857d1a1999974331cac7c5beb4368550d1d15f91d.html — Deep static analysis of SHA-256 bc38233e... (AES-CBC raw overlay loader, 2.5 MB encrypted payload, LsFnDsm0WGBtR7C hardcoded key, keyboard-layout anti-VM, PO1.exe purchase-order lure, unobfuscated CIL). Second confirmed sibling. ^[/intel/analyses/bc38233e18628256407420a857d1a1999974331cac7c5beb4368550d1d15f91d.html]

  • /intel/analyses/931242f8aab64f678147e83833b39bb35111e4359824f7ab694a74d5a80b8f8f.html — Deep static analysis of SHA-256 931242f8... (AES-managed raw overlay loader, 2.38 MB encrypted overlay, AMSI byte-signature bypass, unobfuscated .NET 4.8, P.O_.exe purchase-order lure, UKWES2V322hIwBbJ1183SGJ overlay magic). Third confirmed sibling. ^[/intel/analyses/931242f8aab64f678147e83833b39bb35111e4359824f7ab694a74d5a80b8f8f.html]

  • /intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html — Deep static analysis of SHA-256 673e6738... (AES-CSP raw overlay loader, ~2.1 MB encrypted overlay, AMSI byte-signature bypass, unobfuscated .NET 4.0+, нова_поръчка_pdf.exe Bulgarian purchase-order lure with .pdf.exe double-extension masquerade, 5YHKDOtYsVE2kKl2Ok overlay magic, distinctive method names Fatetpopet2/HolyDamn/FuckUpAgain). Fourth confirmed sibling. ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]

  • /intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html — Deep static analysis of SHA-256 4e31a886... (AES-managed raw overlay loader, ~473 KB encrypted overlay, AMSI byte-signature bypass, unobfuscated .NET 4.5.1, CW_00402902400429..exe tracking-code lure, HzxYPio8S3qwoC6JJuNRNm4 overlay magic, minimal "Holyaya" VS_VERSIONINFO masquerade, shares method names Get_Malware/InjectMem/ComplementaryStrings/FileSplitter with 673e6738). Fifth confirmed sibling. ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html]

  • /intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html — Deep static analysis of SHA-256 5f54948e... (AES-CSP raw overlay loader, ~2.0 MB encrypted overlay, AMSI byte-signature bypass, .NET 4.0+, PO_CW00402902400429.exe purchase-order lure, E2RGfIgBr2yorOvHv0c1R1zXtD overlay magic, "Transponer" / "Boulloart" VS_VERSIONINFO masquerade, Unicode control-character / Hangul jamo CIL name obfuscation, shares method names ComplementaryStrings/Get_AmsiOpenSession_Byte/Get_AmsiScanBuffer_Byte/VirtualProtect/LoadLibrary/GetProcAddress with prior siblings). Sixth confirmed sibling. ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]

Capabilities

  • manifest-resource-aes-gzip-base64-decryption
  • aes-csp-overlay-decryption — AesCryptoServiceProvider + CreateDecryptor + TransformFinalBlock on raw file overlay (FIPS-compliant AES-CSP instead of AesManaged). ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]
  • amsi-bypass-byte-signature-patch — Resolve amsi.dll exports, scan prologue bytes, overwrite with benign stub. ^[/intel/analyses/931242f8aab64f678147e83833b39bb35111e4359824f7ab694a74d5a80b8f8f.html] ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]
  • reflective-native-code-loading
  • runtime-api-resolution-via-pinvoke
  • dynamicmethod-ilgenerator-thunk-generation
  • confuserex-name-mangling
  • keyboard-layout-anti-vm
  • registry-fingerprinting
  • anti-static-minimal-iat
  • social-engineering-game-hack-masquerade
  • social-engineering-purchase-order-masquerade
  • version-info-word-salad-masquerade
  • compile-after-delivery — CompileToAssembly, CompileToAssemblyInternal, CacheCode suggest compiled script / expression-tree payload rather than raw PE. ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]
  • overlay-magic-delimiter — Repeating plaintext magic string at overlay start used as key or delimiter instead of random IV. Observed variants: 5YHKDOtYsVE2kKl2Ok (19 bytes, 673e6738), UKWES2V322hIwBbJ1183SGJ (24 bytes, 931242f8), HzxYPio8S3qwoC6JJuNRNm4 (24 bytes, 4e31a886). ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html] ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html]
  • pinvoke-loadlibrary-getprocaddress — Explicit LoadLibrary("Amsi_dll") and GetProcAddress strings in CIL metadata for runtime API resolution. ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html] ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html] ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]
  • virtualprotect-memory-marking — VirtualProtect string in CIL metadata for marking target pages executable before AMSI patch. ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html] ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html] ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]
  • unicode-control-character-cil-obfuscation — Type and method identifiers renamed to Unicode control-character / Hangul jamo sequences, breaking string-based clustering and decompiler readability. Sixth sibling 5f54948e. ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]
  • double-extension-masquerade — .pdf.exe distribution filename (нова_поръчка_pdf.exe) exploiting Windows Explorer "Hide extensions". ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]
  • shared-method-name-cluster — Get_Malware, InjectMem, ComplementaryStrings, FileSplitter method names shared verbatim across siblings 673e6738 and 4e31a886, indicating a common builder or copy-paste codebase. ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html]
  • holyaya-minimal-masquerade — Single-word VS_VERSIONINFO brand "Holyaya" reused across all metadata fields, simpler than the multi-word word-salad used by prior siblings. ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html]
  • transponer-boulloart-masquerade — VS_VERSIONINFO brand "Transponer" / "Boulloart" with purchase-order filename PO_CW00402902400429.exe. Sixth sibling. ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]

Related Pages