Threat Actors Hiding Malware in Bitmap Resources of NET Applications

By /

Listen to this Post

Featured Image
Unit 42 researchers have uncovered a new obfuscation technique where attackers embed malware within bitmap resources of seemingly benign 32-bit .NET applications. This multistage attack involves extracting, deobfuscating, and executing payloads, ultimately deploying malware such as Agent Tesla, XLoader, and Remcos RAT. The analyzed samples originated from a malspam campaign targeting financial institutions in Türkiye and logistics companies in Asia.

🔗 Read the full report: https://bit.ly/4d5IrbT

You Should Know: How to Detect & Mitigate Such Attacks

1. Analyzing Suspicious .NET Applications

Use dnSpy or ILSpy to decompile .NET binaries and inspect embedded resources: 

dnSpy.exe <malicious_executable.exe>

Check for unusual bitmap resources that may contain obfuscated payloads.

2. Extracting Embedded Payloads

If a bitmap contains hidden data, extract it using PowerShell: 

$file = Get-Content -Path "malware.exe" -Encoding Byte -Raw
$payload = $file[<offset>..<offset+length>]
[System.IO.File]::WriteAllBytes("extracted_payload.bin", $payload)

3. Detecting Malicious Process Injection

Monitor for suspicious process behavior using Sysmon:

<Sysmon>
<EventFiltering>
<RuleGroup name="Process Injection">
<ProcessAccess onmatch="include">
<TargetImage condition="contains">powershell.exe</TargetImage>
<CallTrace condition="contains">unknown</CallTrace>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>

4. Analyzing Network Traffic for C2 Communication

Use Wireshark or TShark to detect C2 traffic:

tshark -r malware_traffic.pcap -Y "http.request or tls.handshake"

5. YARA Rule for Detection

Create a YARA rule to detect such malware:

rule DotNet_Bitmap_Malware {
meta:
description = "Detects .NET malware hiding payloads in bitmap resources"
author = "YourName"
strings:
$dotnet_magic = { 4D 5A } // PE header
$bitmap_resource = "Bitmap" wide ascii
$obfuscated_code = { 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? } // Common obfuscation pattern
condition:
$dotnet_magic at 0 and $bitmap_resource and $obfuscated_code
}

6. Using Volatility for Memory Forensics

If malware executes in memory, analyze RAM dumps:

volatility -f memory.dump --profile=Win10x64 pslist | grep -i "powershell"
volatility -f memory.dump --profile=Win10x64 malfind -p <PID>

What Undercode Say

This technique demonstrates how attackers abuse legitimate .NET features to evade detection. Security teams should:
– Monitor unusual .NET resource modifications
– Deploy YARA rules for static analysis
– Inspect process injection attempts
– Analyze network traffic for hidden C2 channels

Linux defenders can use Radare2 for binary analysis:

r2 -AAA malicious.exe

<blockquote>
  afl  List functions
  iz  Inspect strings/resources

Windows admins should enforce AppLocker policies:

New-AppLockerPolicy -RuleType Publisher,Hash,Path -File <executable> -User Everyone -Deny

For endpoint detection, Elastic Security or CrowdStrike Falcon can help identify such threats.

Expected Output:

  • Detection of hidden payloads in .NET bitmaps
  • Logged process injection attempts
  • Network alerts on suspicious C2 traffic
  • Memory forensics identifying malware remnants

Prediction

Threat actors will increasingly abuse legitimate file formats (like bitmaps, icons, or fonts) to evade detection, requiring enhanced static + dynamic analysis tools. AI-powered malware detection may become essential.

(End of report)

References:

Reported By: Unit42 Unit – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: