A stealthy .NET-based attack framework has been quietly infiltrating Windows environments since early 2022, acting as a launchpad for high-impact malware such as credential stealers and remote access trojans.
Instead of relying on conventional tactics, this threat leverages a layered execution strategy that unfolds across three distinct phases. Each stage is engineered to slip past detection tools, allowing the payload to embed itself deep within the target system.
What makes this loader particularly dangerous is its adaptability. Over time, it has adopted increasingly advanced code obfuscation and cloaking techniques to outmaneuver modern security defenses.
The initial infection vector masquerades as a benign .NET application. Hidden within it are encrypted building blocks for later stages—activated only after bypassing initial scans—setting the stage for full-scale compromise.
Dissecting a Modern Threat: How a Multi-Stage .NET Loader Quietly Delivers Malware
Recent analysis by ThreatRay has uncovered a highly modular .NET-based loader that has been methodically refined over several years to serve as a dependable vehicle for delivering various malware families. Rather than following predictable patterns, newer versions embed malicious components within image data—specifically bitmap resources—marking a significant shift from earlier approaches that relied on static string-based payloads.
This shift in technique reflects a deliberate evolution. The threat actors behind the loader have steadily upgraded their methods to sidestep traditional detection mechanisms, investing heavily in stealth rather than novelty.
Through deep code comparison and reuse pattern analysis, researchers linked over 20,000 samples gathered across a three-year span. While the loader’s first and second stages often mutate to avoid signature-based defenses, the third stage remains largely unchanged—providing analysts a reliable foothold for identifying new variants.
According to the research team, the loader’s real value lies not in introducing cutting-edge malware, but in offering a rich source of fresh indicators of compromise (IOCs). Its consistent structure makes it an effective harbinger of ongoing campaigns rather than a tool for first-contact detection.
Staging the Attack: An Inside Look at Execution Flow
This loader’s architecture is notable for its consistency and technical layering. Between March 2022 and February 2025, data shows that it repeatedly deployed known commodity malware—including AgentTesla, Formbook, Remcos, and 404Keylogger—with precision and scale.
Here’s how the loader unfolds in practice:
- The initial stage starts with a .NET executable, which extracts and decrypts embedded assets.
- The second stage, loaded directly in memory, is a .NET DLL that accepts three parameters. These are used to locate a hidden bitmap within the original executable, extract it, and decrypt its contents using XOR-based methods.
- The third stage—a decrypted payload—executes directly in memory, bypassing the file system entirely and delivering the final malicious software.
Below is a streamlined example of the decryption logic used to reconstruct and activate the embedded assembly:
C#
public static void main(string ResourceName, string XORKey, string ModuleName)
{
MainForm.loops_1();
MainForm.sleep();
ResourceName = MainForm.decode_string(ResourceName);
MainForm.loops_2();
XORKey = MainForm.decode_string(XORKey);
Bitmap bitmap = MainForm.get_resource(ResourceName, ModuleName);
byte[] array = MainForm.convert_bitmap_to_array(bitmap);
array = MainForm.decrypt_array(array, XORKey);
Assembly assembly = MainForm.assembly_load(array);
MainForm.get_type_20_method_29_and_invoke(assembly);
MainForm.exit();
}
This tightly controlled execution chain allows the threat to remain hidden throughout the infection lifecycle, sidestepping both signature-based detection and behavioral analysis tools.
Conclusion: A Threat Engineered for Persistence
What sets this loader apart is not innovation in the malware it delivers, but the surgical precision with which it operates. Its layered architecture, evolving concealment strategies, and reliable delivery methods make it a formidable backend for cybercriminal operations. While the payloads it carries may vary, the infrastructure beneath remains a constant—and growing—threat.
