VBS Stager to In-Memory C# Loader
From an obfuscated VBS dropper through two PowerShell stages to a fileless C# loader that hides its strings in a DES-encrypted resource and hollows RegAsm.
[ TAG ]
powershell
4 malware analysis write-ups tagged powershell.
-
-
Lowlevel Windows Functions in Powershell - REMCOS Dropper
Multistage Dropper with a lot of obfuscation and evasion techniques -
Fileless .NET DLL - RAT
A javascript file that stages Powershell and extracts a malicous .NET Dll from an image. -
Powershell Dropper - Analysis
This is my first Malware Analysis, i am trying to elaborate my thought process as well as techniques I used to get rough it.