Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

**Executive Summary:** This Unit 42 analysis details a multi-stage malspam campaign (late 2024–early 2025) that embeds malicious payloads within bitmap resources of otherwise benign 32-bit .NET applications using steganography and layered loaders to deliver info-stealers and RATs (Agent Tesla, XLoader, Remcos); the report reconstructs the unpacking chain, provides SHA-256 hashes, C2 domains and SMTP exfiltration credentials, and recommends detection/mitigation approaches such as intercepting ResourceManager and Assembly.Load calls.