New .NET Multi-Stage Loader Targets Windows Systems to Deploy Malicious Payloads

A recently discovered .NET-based multi-stage loader has caught the attention of cybersecurity researchers due to its complex architecture and ability to deploy a range of malicious payloads on Windows systems.

Tracked since early 2022 by Threatray, this loader employs a sophisticated three-stage process to deliver commodity stealers, keyloggers, and Remote Access Trojans (RATs) such as AgentTesla, Formbook, Remcos, and 404Keylogger.

The loader’s design, which embeds encrypted payloads across multiple stages, demonstrates a high level of obfuscation, making detection and analysis challenging for traditional security tools.

– Advertisement –

With over 20,000 samples identified over three years through code reuse clustering, this loader represents a persistent and evolving threat in the malware landscape.

Three-Stage Loading Mechanism Unveiled

The loader operates by first executing a .NET executable that contains encrypted data for the subsequent stages, often hidden within bitmap resources in newer variants-a technique also noted by Unit42 from Palo Alto Networks.

The second stage, a .NET DLL, decrypts and loads the third stage into memory using XOR-based decryption, while the final stage deploys the malicious payload.

Threatray’s analysis highlights the stability of the third stage’s code structure, enabling effective tracking via a custom YARA rule designed to detect its presence across malware feeds.

The payloads deployed predominantly include information stealers and RATs, with families like AgentTesla and Remcos appearing frequently between March 2022 and February 2025.

Interestingly, while the loader provides fresh samples and Indicators of Compromise (IOCs), it has limited value in early detection of new malware families, as variants like XWorm and NovaStealer emerged in this loader long after their initial discovery, though VIPKeylogger was identified simultaneously with its appearance in the wild.

Payload Distribution and Tracking Insights

Further deepening the intrigue, researchers noted that the loader’s developers have embedded gaming-inspired function names-such as those referencing Fruit Ninja and Monster Hunter-in the second stage’s deployment routines.

These unique identifiers could serve as additional IOCs for tracking purposes.

The loader’s ability to adapt, evidenced by the shift from hardcoded strings to bitmap resources for payload storage, underscores its maintainers’ efforts to evade static analysis and signature-based detection systems.

This adaptability, combined with the sheer volume of samples observed, points to a well-organized operation behind the loader, though attribution to a specific threat actor or family remains elusive.

The cybersecurity community is encouraged to share insights to better understand the origins and operators of this threat.

Below is a summarized table of key IOCs associated with the loader, detailing payload locations, initial sample hashes, extracted third-stage hashes, and the final payload families deployed.

Indicators of Compromise (IOC)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!