unclassified-dotnet-native-aot-loader

Umbrella label for malware built with .NET Native AOT (PublishAot) that embeds a large encrypted payload inside a custom-named PE resource. The AOT compilation strips all CLR metadata, rendering the binary opaque to conventional .NET analysis tools while inflating file size to 4–10 MB with inlined BCL runtime.

Observed Samples

Build Stack

• Compiler: .NET 8+ SDK with PublishAot=true, RID win-x64.
• Linker: MSVC 14.38–14.40 (Visual Studio 2022 v143).
• Runtime artefacts: System.Private.CoreLib, Internal.Runtime.TypeLoader, RhGetGcTotalMemory, CanonType, UniversalCanonType, DotNetRuntimeDebugHeader export.
• CLR metadata: Absent — COM_DESCRIPTOR virtual address is 0x0.

Deploy / TTPs

• Anti-analysis: Native AOT defeats dnSpy/ILSpy/de4dot; no IL to disassemble. ^[raw/analyses/ef48ae9e.../report.md]
• Payload staging: Encrypted blob stored as custom BINARY or RCDATA resource; decrypted at runtime by AOT-compiled stub. ^[raw/analyses/ef48ae9e.../report.md]
• Network: Via natively compiled System.Net.Http — no Winsock imports in IAT. ^[raw/analyses/ef48ae9e.../report.md]
• Masquerade: Version-info fields populated with bland or nonsensical strings (e.g., SetVersionHasValue). ^[raw/analyses/ef48ae9e.../report.md]

Capabilities

• dotnet-native-aot-compilation-evasion
• custom-resource-encrypted-payload
• runtime-http-client-no-iat
• version-info-masquerade
• self-contained-runtime-no-clr

Related Pages

• dotnet-native-aot-rat-compilation — technique deep-dive on Native AOT as anti-analysis
• version-info-masquerade — version-info fabrication pattern
• valleyrat — tentative OpenCTI co-label for one sibling
• silverfox — co-labeled cluster (different build stack)