New .NET AOT Malware Hides Code as a Black Box to Evade Detection

Howler Cell researchers uncovered a multi-stage .NET Ahead-of-Time (AOT) malware campaign spread via phishing ZIPs: KeyAuth.exe downloads bound_build.exe which XOR-decrypts and launches two payloads — Crypted_build.exe (delivering the Rhadamanthys infostealer) and Miner.exe (installing MicrosoftEdgeUpdater, a loader for XMRig). The attackers use AOT compilation to remove metadata and a scoring-based sandbox-evasion check (RAM, uptime, document file count, AV processes) to avoid analysis; analysts recovered functionality using Binary Ninja and a custom WARP signature. Users are advised to avoid untrusted ZIPs and keep systems updated.