unclassified-dotnet-transmock-masquerade

Tentative family label for .NET Framework PE32 binaries that masquerade as the legitimate open-source BizTalk testing utility TransMock while embedding malicious downloader, decryption, and staging classes under the same namespace. Single observed sample (f3bc22f6). Low-confidence attribution.

Overview

Build Stack

• Compiler: Roslyn C# (Visual Studio 2019/2022), .NET Framework 4.x, v4.0.30319
• PDB path: C:\Users\Admin2024\Desktop\Outputs\Udflopli.pdb
• Internal name: Udflopli.exe
• Packing / obfuscation: None. Full IL metadata intact.
• Signing: Unsigned
• Anti-analysis: Heavy benign surface area (FrodLib utility library ~180 classes); semantic-jargon class names (CrewPickupSM, ScopeFpgaI2c) to slow manual triage.

Deploy / TTPs

• T1620 — Reflective .NET assembly loading (delegate invocation chain)
• T1053.005 — Scheduled task creation (capa inference)
• T1083 — File and directory discovery (FrodLib file-system utilities)
• T1082 — System information discovery (environment queries)
• C2 protocol: WinHTTP over HTTPS (runtime-resolved URL)

Capabilities

• winhttp-download-https
• runtime-payload-decryption
• reflective-assembly-delegate-execution
• scheduled-task-persistence
• semantic-jargon-class-name-camouflage
• legitimate-library-masquerade — copies TransMock version info / copyright / description
• large-benign-dependency-bloat — embeds FrodLib IoC/collections/math to inflate string surface

Related Entities

• unclassified-dotnet — umbrella for unattributed .NET binaries
• legitimate-library-masquerade — concept page for malware cloning real open-source project identities