VBS Stager to In-Memory C# Loader
From an obfuscated VBS dropper through two PowerShell stages to a fileless C# loader that hides its strings in a DES-encrypted resource and hollows RegAsm.
[ TAG ]
process-hollowing
1 malware analysis write-up tagged process-hollowing.