New .NET AOT Malware Conceals Code in Stealthy Black Box Architecture

Mar 19
1 min read

Key Findings

* New .NET AOT malware campaign discovered by Howler Cell researchers

* Uses Ahead-of-Time (AOT) compilation to evade standard security detection

* Multi-stage attack with sophisticated evasion techniques

* Targets individual systems through phishing emails

* Employs complex scoring system to determine victim validity

Background

The emergence of this malware represents a sophisticated evolution in cyberthreat techniques. Traditional malware detection relies on analyzing software metadata, but this new approach strips away those digital markers, effectively creating a "black box" that obscures the malware's true intentions.

Attack Methodology

The attack typically begins with a phishing email containing a suspicious ZIP file. When downloaded, the malware follows a complex infection chain:

* Initial file: KeyAuth.exe (downloader)

* Secondary file: bound_build.exe (attack architect)

* Additional payloads:

Crypted_build.exe (retrieves Rhadamanthys infostealer)
Miner.exe (installs disguised cryptocurrency miner)

Evasion Techniques

The malware uses an intelligent scoring system to avoid detection:

* Checks system RAM (bonus points for >8GB)

* Evaluates system uptime

* Counts files in Documents folder

* Scans for known antivirus processes

* Automatically terminates if score is below 5

Detection Breakthrough

Researchers at Howler Cell used Binary Ninja with a custom WARP signature to:

* Reconstruct program's inner workings

* Increase visibility from <1% to 85%

* Bypass complex obfuscation techniques

Mitigation Recommendations

* Avoid downloading ZIP files from untrusted sources

* Keep system software updated

* Maintain current antivirus protection

* Be cautious of suspicious email attachments

Sources

https://hackread.com/net-aot-malware-code-black-box-evade-detection/
https://x.com/Dinosn/status/2034267110390608070
https://www.socdefenders.ai/item/84a87a30-92d7-4147-8566-e7ee720c6458
https://www.linkedin.com/posts/cyber-news-live_new-net-aot-malware-hides-code-as-a-black-activity-7440173844247539712-vdpp