Unclassified .NET Whisper Loader

Internal module name vVth.exe, namespace Whisper.Properties.Resources, distributed under double-extension document lures. Single observed sample; low-confidence family.

Overview

A .NET Framework 4.0 PE32 loader/dropper cluster characterized by:

• Empty VS_VERSIONINFO except for vVth.exe internal name
• All type and method identifiers obfuscated with Unicode control characters and zero-width spaces
• Custom BouncyCastle.CryptoExt assembly reference for AES/RSA operations
• Large encrypted manifest resource (~919 KB) likely carrying the second-stage payload
• No hardcoded C2 strings; network config expected to be runtime-decrypted

Build Stack

Deploy / TTPs

• T1027 — Obfuscated Files or Information (Unicode name mangling)
• T1140 — Deobfuscate/Decode Files or Information (AES + RSA resource decryption)
• T1620 — Reflective Code Loading (expected Assembly.Load of decrypted resource)
• T1083 — File and Directory Discovery (file enumeration in .NET)
• C2 — TCP client capability observed; no static C2 strings

Capabilities

• dotnet-manifest-resource-decryption
• aes-rsa-bouncycastle-payload-crypto
• unicode-control-character-name-obfuscation
• tcp-client-c2
• reflective-assembly-load
• double-extension-masquerade
• empty-version-info

Variants / Aliases

• None known. Single sample (d9c0bc24) observed as TTcopy_pdf.exe.

Notable Analyses

• d9c0bc24 — Deep static analysis (no CAPE dynamic execution available)

Related

• unicode-control-character-name-obfuscation — technique page
• dotnet-manifest-resource-decryption — generic decryption pattern
• double-extension-masquerade — filename trick
• social-engineering-filename-lure — lure taxonomy