Reversing Multilayer .NET Malware
Summary: Cisco Talos analyzed a .NET malware sample (SHA256 ADA8229CE99B8386E89EB94ECAB678AE79C8638B3EAF3532B847CFF2B201C232) that disguised itself as an image of a woman and used steganography in a 462x462 32-bit bitmap to decrypt and execute a second dropper. That dropper installed the Kazy userland rootkit and a DarkComet 5.1 backdoor using RC4 encryption with the key #KCMDDC51#-890gotogoa, which sent repeated 22-byte #KEEPALIVE# signals to its command and control server.
Bottom line: The recurring 22-byte KEEPALIVE beacon is the most reliable detection point in the chain, and Talos shipped signatures for it (Snort SID 31814, ClamAV Win.Trojan.Kazydropper and Kazyinvoker, FireAMP W32.Auto.ada822.MASH.RT.SBX.VIOC) - if those signatures are not current on your sensors, this infection stays invisible.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026