> Family · unclassified-dotnet-strong-masquerade_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-strong-masquerade.md

typeentityconfidencelowcreated2026-06-24updated2026-06-24dotnetmalware-familyloaderobfuscationpayloadcode-injectiondefense-evasionreflective-loadingmasquerade

unclassified-dotnet-strong-masquerade

Overview

A single-observed .NET Framework 64-bit reflective loader/crypter family. The outer binary masquerades as a utility named "Strong" (ProductName Strong, OriginalFilename Strong.exe, Copyright 2024) to appear legitimate. It decrypts a multi-layer payload from the .rsrc section using AES + GZip + Base64, then bridges into native code via P/Invoke (GetProcAddress, GetModuleHandle) and MethodInfo.Invoke. All behavior is inferred from static analysis; no CAPE detonation is available.

Build Stack

  • Language: C# / .NET Framework, PE32+ (AMD64) ^[sample ce07d963/file.txt]
  • Compiler: csc / Roslyn (Microsoft.CodeAnalysis.EmbeddedAttribute present) ^[sample ce07d963/capa.txt]
  • Obfuscator: ConfuserEx or derivative (20-char random Unicode surrogate name mangling, minimal IAT, high-entropy .rsrc) ^[raw/analyses/ce07d963d3c52f34db80ac871c3d590a49b9c8c5355130a23ca7f18a9cd08a5e/r2:exports]
  • Packer: None native — remains a valid .NET assembly with 2 sections ^[sample ce07d963/file.txt]
  • Signing: Unsigned (no Authenticode signature) ^[sample ce07d963/file.txt]

Deploy / TTPs

MITRE ATT&CK Technique Evidence
T1027 Obfuscated Files or Information AES + GZip + Base64 layered resource encryption; heavy IL-level name mangling ^[sample ce07d963/strings.txt] ^[sample ce07d963/capa.txt]
T1140 Deobfuscate/Decode Files or Information CreateDecryptor, GZipStream, Convert.FromBase64String (inferred) ^[sample ce07d963/strings.txt]
T1620 Reflective Code Loading Assembly.Load + MethodInfo.Invoke + Marshal.GetDelegateForFunctionPointer ^[sample ce07d963/capa.txt]
T1129 Shared Modules GetProcAddress / GetModuleHandle runtime P/Invoke linking ^[sample ce07d963/capa.txt]
T1055 Process Injection (inferred) manipulate unmanaged memory in .NET + GetDelegateForFunctionPointer suggests native shellcode/DLL injection ^[sample ce07d963/capa.txt]
C0021.003 Generate Pseudo-random Sequence Random class usage (likely for key/IV or jitter) ^[sample ce07d963/capa.txt]

Variants / Aliases

  • Strong.exe (original filename)
  • Strong (product name)

Notable Analyses

  • /intel/analyses/ce07d963d3c52f34db80ac871c3d590a49b9c8c5355130a23ca7f18a9cd08a5e.html — Deep static analysis of SHA-256 ce07d963...

Capabilities

  • manifest-resource-aes-gzip-base64-decryption
  • reflective-native-code-loading
  • runtime-api-resolution-via-pinvoke
  • dynamicmethod-ilgenerator-thunk-generation
  • confuserex-name-mangling
  • anti-static-minimal-iat
  • social-engineering-utility-masquerade

Related Pages