New Stealthy .NET Malware Concealing Malicious Payloads in Bitmap Resources

This report documents a malspam-driven campaign (250+ emails) distributing 32-bit .NET executables that hide successive loader stages inside bitmap resources via steganography; the chained loaders, employing metadata/control-flow obfuscation and string encryption, decrypt and execute final payloads such as Agent Tesla, XLoader, or Remcos RAT for credential theft and remote access. The analysis includes a detailed infection workflow, recommended dynamic analysis techniques (intercepting .NET ResourceManager and assembly loading), and comprehensive IOCs (SHA-256 hashes, C2 endpoints, sender/receiver emails and credentials) to aid detection and response.