> Family · Unclassified .NET Protobuf Loader_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-protobuf-loader.md

typeentityconfidencemediumcreated2026-07-04updated2026-07-04dotnetmalware-familyloaderc2defense-evasionsigningmitre-attck

Unclassified .NET Protobuf Loader

A .NET Framework PE32 malware family characterized by:

  • Valid Authenticode code-signing certificate (Sectigo chain observed)
  • Masquerade as legitimate Indonesian antivirus software ("Smadav Updater")
  • Heavy use of System.Reflection.Emit for runtime code generation
  • protobuf-net serialization combined with System.ServiceModel (WCF) networking
  • AES + Base64 encrypted embedded config in CLR User String heap
  • Absence of anti-VM/anti-debug checks — relies on certificate trust for evasion

First observed: 2024-08-13 (compilation timestamp). Single sample at time of writing.

Build Stack

  • Compiler: .NET Framework v4.0.30319 (CLR 4.x)
  • Libraries: protobuf-net, System.ServiceModel, System.Reflection.Emit, System.Security.Cryptography
  • Packing: None (intact IL metadata)
  • Obfuscation: None (unobfuscated namespace Ngwdqommvm)
  • Signing: Valid Sectigo code-signing certificate ^[/intel/analyses/6cdc73c825f3c1dd9d61f8ba2cc4f8a7c43f1236d94f196191c7a2a922ecb3d9.html]

Capabilities

  • valid-authenticode-masquerade
  • protobuf-net-wcf-c2-serialization
  • reflection-emit-runtime-method-generation
  • aes-base64-embedded-config-decryption
  • dynamic-assembly-reflective-loading
  • multi-cipher-crypto-support-aes-des-tripledes-rijndael-rc2
  • no-anti-vm-trust-based-evasion

Deploy / TTPs

Technique ID Evidence
Reflective Code Loading T1620 Assembly.Load(byte[]) + Delegate.CreateDelegate + reflection.Emit
Deobfuscate/Decode Files or Information T1140 Base64 + AES decryption pipeline
Obfuscated Files or Information T1027 Encrypted payload in #US heap
Generate Pseudo-random Sequence C0021.003 .NET PRNG API usage

Variants / Aliases

  • None confirmed. Single sample: Revised_506133.exe (SHA-256 6cdc73c825f3c8...)

Notable Analyses

  • /intel/analyses/6cdc73c825f3c1dd9d61f8ba2cc4f8a7c43f1236d94f196191c7a2a922ecb3d9.html — Static-only deep dive (no CAPE detonation)

Related