Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources
Summary: Unit 42 documented a malspam campaign running from late 2024 into early 2025 that hid malware inside bitmap resources of otherwise benign 32-bit .NET applications, with one wave targeting financial organizations in the Republic of Türkiye and another targeting logistics in Asia across more than 250 emails. The analyzed sample, a copy of a legitimate Windows Forms OCR executable, ran a multi-stage chain unpacking bitmap resources into TL.dll and Montero.dll before XOR-decrypting a byte array into the final Agent Tesla payload named Remington.exe.
Why it matters: The delivery file is a working copy of a legitimate application, so the payload arrives as a bitmap inside software that looks benign, and the chain ends in Agent Tesla, XLoader or Remcos RAT - established families built to hold an initial foothold rather than to announce themselves.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026