{"id":11677,"date":"2026-03-25T12:59:59","date_gmt":"2026-03-25T12:59:59","guid":{"rendered":"https:\/\/events.aavar.org\/avar2025\/?page_id=11677"},"modified":"2026-03-25T12:59:59","modified_gmt":"2026-03-25T12:59:59","slug":"shadows-in-native-code-the-rise-of-aot-compilation-in-modern-net-malware","status":"publish","type":"page","link":"https:\/\/events.aavar.org\/avar2025\/index.php\/shadows-in-native-code-the-rise-of-aot-compilation-in-modern-net-malware\/","title":{"rendered":"Shadows in Native Code: The Rise of AOT Compilation in Modern .NET Malware"},"content":{"rendered":"\n[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column]\n\n\n\n
\n
\n
<\/div>\n\n\n\n

AGENDA<\/p>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n\n\n\n

[\/vc_column] [\/vc_row]<\/p>\n\n\n\n

<\/div>\n\n\n\n

<— Back<\/a><\/strong><\/p>\n\n\n\n

Shadows in Native Code: The Rise of AOT Compilation in Modern .NET Malware<\/p>\n\n\n\n

The landscape of malware development is experiencing a significant shift as threat actors increasingly leverage Ahead of Time (AOT) compilation in .NET frameworks. Traditionally, .NET applications have been relatively straightforward to reverse engineer due to their intermediate language representation, which preserves substantial program structure and metadata. However, the growing adoption of AOT compilation\u2014which transforms .NET code directly into native machine code\u2014presents formidable new challenges for security researchers and malware analysts.<\/p>\n\n\n\n

Our preliminary research indicates that approximately 75% of .NET AOT samples identified in the wild demonstrate malicious intent, suggesting this technique has been rapidly embraced by threat actors. AOT compilation effectively eliminates the Microsoft Intermediate Language (MSIL) layer, forcing analysts to work directly with assembly code and significantly complicating the reverse engineering process. This technique serves as an emerging obfuscation strategy that requires minimal effort from malware authors while providing substantial protection against analysis.<\/p>\n\n\n\n

This paper examines the technical characteristics of AOT-compiled malware, presents methodologies for identification and analysis of these samples, and explores the development of specialized tools to recover function signatures and type information. We demonstrate how traditional .NET analysis techniques fail against AOT-compiled binaries and propose new approaches combining static and dynamic analysis to overcome these limitations. Furthermore, we discuss the security implications of Microsoft’s continued enhancement of AOT capabilities in newer .NET versions, which inadvertently provides malware authors with increasingly sophisticated evasion techniques.<\/p>\n\n\n\n

As AOT compilation becomes more accessible with each .NET release, understanding its security implications becomes critical for maintaining effective malware detection and analysis capabilities in the evolving threat landscape.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\n
\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n

Sarang Popat Sonawane – Crowdstrike<\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n\n\n\n

Sarang Sonawane currently holds the role of Security Researcher within CrowdStrike’s Malware Research Team, boasting 9+ years of experience with a primary focus on reverse engineering.<\/p>\n\n\n\n

In recognition of his expertise, he has presented at security conferences, including BlackHat MEA and AVAR. He also loves playing CTF challenges and has successfully completed the Flare-On 9 and 11 security challenges.<\/p>\n\n\n\n

Beyond his dedication to cybersecurity, Sarang thrives on intellectual challenges in the malware analysis domain. When not dissecting malicious code, he passionately engages in cricket matches and eagerly explores new destinations, satisfying his adventurous spirit.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column] AGENDA [\/vc_column] [\/vc_row] <— Back Shadows in Native Code: The Rise of AOT Compilation in Modern .NET Malware The landscape of malware development is experiencing a significant shift as threat actors increasingly leverage Ahead of Time (AOT) compilation in .NET frameworks. Traditionally, .NET applications have been relatively straightforward to reverse engineer due to their intermediate<\/p>\n

<\/div>\n

Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-11677","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11677","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/comments?post=11677"}],"version-history":[{"count":1,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11677\/revisions"}],"predecessor-version":[{"id":11679,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11677\/revisions\/11679"}],"wp:attachment":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/media?parent=11677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}