Malware - New .NET AOT Malware Evades Detection with Scoring

What Happened

Researchers at Howler Cell have uncovered a sophisticated malware campaign that employs .NET Ahead-of-Time (AOT) compilation techniques. This innovative approach allows the malware to strip away metadata, making it challenging for standard security solutions to detect and analyze. The campaign typically starts with a phishing email that contains a malicious ZIP file. Once the user opens it, a file named KeyAuth.exe is executed, which acts as a downloader for the main orchestrator, bound_build.exe.

This orchestrator is responsible for decrypting and launching two additional threats: Crypted_build.exe, which deploys the Rhadamanthys infostealer, and Miner.exe, disguised as MicrosoftEdgeUpdater, which operates as a loader for the XMRig cryptocurrency miner. This multi-layered approach not only enhances the malware's functionality but also complicates detection efforts by security tools.

Who's Being Targeted

The primary targets of this malware campaign appear to be individuals and organizations that may fall victim to phishing attacks. By leveraging sophisticated scoring systems, the malware can distinguish between genuine targets and analysis environments. It evaluates various factors, including the amount of RAM (over 8GB), system uptime, the number of files in the Documents folder (more than 10), and the presence of antivirus processes like WinDefend or Kaspersky.

If the calculated score is below a threshold of 5, the malware self-terminates, effectively avoiding detection. This targeted approach increases the likelihood of successful infiltration into systems that meet its criteria, making it a significant threat.

Signs of Infection

Users may notice several signs of infection if they fall victim to this malware. The presence of unexpected processes such as KeyAuth.exe, bound_build.exe, or Miner.exe running on their systems can indicate an infection. Additionally, users may experience unusual system behavior, such as slow performance or unexpected network activity due to the cryptocurrency mining operations.

To further complicate matters, the malware's ability to self-terminate when it detects a non-target environment means that users may not always realize they have been compromised until it is too late. Regular monitoring of system performance and unusual file activity can help in early detection.

How to Protect Yourself

To safeguard against this evolving threat, users should adopt a multi-layered security approach. Here are some recommended actions:

• Educate yourself and your team about phishing tactics to avoid falling victim to such attacks.
• Implement robust antivirus solutions that can detect and mitigate advanced threats.
• Regularly update software and operating systems to patch vulnerabilities that malware may exploit.
• Monitor system performance and network activity for any unusual behavior that could indicate an infection.

By being proactive and vigilant, users can significantly reduce their risk of falling prey to this new .NET AOT malware campaign.