> Technique · .NET Native AOT Compilation for Malware_

~/packetpursuit $ cat /intel/techniques/dotnet-native-aot-rat-compilation.md

typetechniquecreated2026-06-14updated2026-06-14anti-analysisdotnetevasioncompilation

.NET Native AOT Compilation for Malware

.NET Native AOT (ahead-of-time compilation via PublishAot) compiles managed IL into native machine code, producing a self-contained PE with no CLR header, no IL metadata, and no COM_DESCRIPTOR directory. The resulting binary resembles a native C/C++ executable, defeating conventional .NET analysis workflows (dnSpy, ILSpy, de4dot) and many EDR heuristics that look for CLR artefacts.

How it works

  1. Developer writes C# code using standard .NET base-class libraries (System.Net.Http, System.Security.Cryptography, Microsoft.Win32.Registry, etc.).
  2. Project file sets <PublishAot>true</PublishAot> with a Windows RID (win-x64).
  3. dotnet publish invokes ILC (IL Compiler) to generate a native PE with the runtime statically linked.
  4. Output is a single 8–15 MB executable containing the entire BCL, runtime GC, thread scheduler, and user code — all as native x64 instructions.

Static-analysis impact

Conventional .NET analysis Native AOT result
dnSpy / ILSpy No CLR metadata → fails to open
de4dot / ConfuserEx unpackers No packer detected; not .NET assembly
Strings extraction Massive noise from embedded BCL (10 000+ strings)
API imports Standard Win32 imports plus Brotli/crypt32 exports
Decompilation Requires Ghidra / IDA / radare2 native decompilation

Detection heuristics

  • No COM_DESCRIPTOR in PE data directories
  • Export DotNetRuntimeDebugHeader — standard Native AOT artefact
  • Version strings like 10.0.14.xxxxx in .rdata
  • Async state-machine names in strings: \u003cSendAsync\u003ed__, \u003cConnectAsync\u003ed__
  • BCL DLL names in .rdata: System.Net.Http.dll, System.Security.Cryptography.dll

Observed in the wild

  • fbc07658...abce15 — ValleyRAT / SilverFox co-labeled sample, 10 MB, Update.dll masquerade, 52pojie build provenance. ^[raw/analyses/fbc07658.../report.md]
  • ef48ae9e...3170a — 5.5 MB purchase-order lure (PO147222D_f_d_p_..exe), SetVersionHasValue.dll masquerade, 3.2 MB encrypted BINARY resource (ZZERIUIN7HDZATO9A1). Static-only analysis. ^[raw/analyses/ef48ae9e.../report.md]

References

  • valleyrat — family entity with Native AOT variant
  • silverfox — related cluster; conventional Rust/C builds