> Family · unclassified-dotnet-tripledes-resource-loader_

~/packetpursuit $ cat /intel/families/unclassified-dotnet-tripledes-resource-loader.md

typeentityconfidencemediumcreated2026-07-10updated2026-07-21dotnetmalware-familyloaderobfuscationdefense-evasionpayloadcode-injectiondiscovery

unclassified-dotnet-tripledes-resource-loader

Overview

A .NET Framework crypter/loader family that encrypts its second-stage payload as an embedded .resources blob, decrypts it at runtime using TripleDESCryptoServiceProvider with a hardcoded Base64 key/IV pair, and reflectively loads the inner assembly via Assembly.Load(byte[]). The outer binary masquerades as a benign application with purchase-order themed filenames. Three confirmed siblings as of 2026-07-21.

Build Stack

  • Language: C# / .NET Framework 4.0+ ^[/intel/analyses/5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f.html]
  • Compiler: csc targeting .NET Framework 4.0 (metadata version v4.0.30319) ^[/intel/analyses/5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f.html]
  • Linker: Version 8.0 (VS 2005 era) with a 2024 timestamp — anachronistic, may indicate ILASM/rebuild pipeline ^[/intel/analyses/5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f.html]
  • Obfuscator: None (no ConfuserEx, SmartAssembly, or Xenocode signatures) ^[/intel/analyses/5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f.html]
  • Packer: None native — remains a valid .NET assembly
  • Signing: Unsigned

Deploy / TTPs

MITRE ATT&CK Technique Evidence
T1140 Deobfuscate/Decode Files or Information Convert.FromBase64String → TripleDESCryptoServiceProvider.CreateDecryptor → CryptoStream chain ^[/intel/analyses/5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f.html] ^[/intel/analyses/1051b5a48a4db66f11b8a28762bc7fae03de6b0a425dbfea26f89b0d99506959.html]
T1620 Reflective Code Loading Assembly.Load(byte[]) inferred from InvokeMember reference and capa hits ^[sample 5e1922a7/capa.txt] ^[sample 1051b5a4/capa.txt]
T1033 System Owner/User Discovery get session user name capa hit in sibling 1051b5a4 ^[sample 1051b5a4/capa.txt]

Variants / Aliases

  • new request.exe — distribution filename (sibling 5e1922a7)
  • sc_copy.exe — distribution filename (sibling 1051b5a4)
  • PO1029837346 Dec 1015.exe — distribution filename (sibling e8744da8)
  • Namespace Nmvffwquw, class Diqzw — auto-generated crypter identifiers (sibling 5e1922a7)
  • Namespace Axdne, class Cptnzhewmk — auto-generated crypter identifiers (sibling 1051b5a4)
  • Namespace Edodhixbr, class Spigbfcw / Gscpj — ConfuserEx-mangled identifiers (sibling e8744da8)

Notable Analyses

  • /intel/analyses/5e1922a744bc4df2ef384022a4554908baab68c8ee6c14305130c1d4fef79a3f.html — Deep static analysis of SHA-256 5e1922a7... (TripleDES + Base64 resource decryption, "new request" masquerade, no P/Invoke, no ConfuserEx). Static-only (CAPE skipped).
  • /intel/analyses/1051b5a48a4db66f11b8a28762bc7fae03de6b0a425dbfea26f89b0d99506959.html — Deep static analysis of SHA-256 1051b5a4... (TripleDES + Base64 resource decryption, "sc copy" masquerade, no P/Invoke, no ConfuserEx, key/IV not recoverable statically). Static-only (CAPE skipped).
  • /intel/analyses/e8744da8113beed4a9f4f0c986e737b5f3711fb94a76a8daadc5b41c6745d863.html — Deep static analysis of SHA-256 e8744da8... (TripleDES + Base64 resource decryption, PO1029837346 Dec 1015.exe purchase-order masquerade, ConfuserEx obfuscation, 1.3 MB encrypted payload, Assembly.Load → Delegate.CreateDelegate → DynamicInvoke reflective execution). Third confirmed sibling. Static-only (CAPE skipped).

Capabilities

  • dotnet-resource-tripledes-decryption
  • base64-encoded-crypto-material
  • reflective-assembly-loading
  • minimal-iat-single-import
  • randomized-cil-namespace-obfuscation
  • generic-version-info-masquerade
  • no-pinvoke-bridge
  • no-commercial-obfuscator
  • get-session-username-discovery — capa T1033 hit in sibling 1051b5a4; may be inner-payload behaviour

Related Pages