Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Uncovering .NET Malware Obfuscated by Encryption and Virtualization

Summary: Unit 42 examined .NET malware samples that hide payloads in the PE overlay behind AES encryption in CBC mode, using a marker string (gXQstjDplQeg) to delimit the key, IV and ciphertext, with \x00-prefix and PAPADDINGXX suffix padding to evade signature-based detection. The second stage uses KoiVM, a ConfuserEx plugin, to wrap a dropper in a custom virtual machine whose opcodes may be remapped so tools like OldRod fail, and the final in-memory payload was mainly Agent Tesla or XWorm, with one FormBook/XLoader shellcode sample.

What you should know: Each layer is encrypted with strong AES and the final payload never touches disk, so a sandbox relying on static analysis sees only ciphertext and a VM interpreter - and the XWorm samples keep their AES key in a variable named Mutex, leaving C2 endpoints recoverable only after the dropper is hooked and run.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026