Fileless Malware CactusTorch Executes Harmful .NET Assemblies From Memory

Minimalist · Aug 10, 2018

On July 26, researchers at McAfee Labs reported that they compiled the tool and uncovered the .NET executable DotNetToJScript.exe. The executable accepts a .NET assembly responsible for creating a new suspended process, allocating memory, writing shellcode in the target’s memory process and creating a thread to execute the shellcode.

DotNetToJScript does not ship out with CactusTorch. It ultimately yields only a JavaScript file containing the .NET assembly. The script host (wscript.exe) executes the JavaScript file on a target system.
Click to expand...

https://securityintelligence.com/ne...-executes-harmful-net-assemblies-from-memory/

Peter2150 · Aug 10, 2018

Just keep wscript.exe blocked and your safe from this one.

itman · Aug 10, 2018

DotNetToJScript.exe has been deployed by other delivery methods as noted below.

For example, James demonstrated how to combine DotNetToJScript with com hijacking and Casey’s squiblydoo technique to inject code into protected processes. In another example, Casey weaponized DotNetToJScript in universal.js to execute arbitrary shellcode or PowerShell commands.
Click to expand...

https://www.endgame.com/blog/technical-blog/hunting-memory-net-attacks

EASTER · Aug 10, 2018

itman said: ↑

DotNetToJScript.exe has been deployed by other delivery methods as noted below.

https://www.endgame.com/blog/technical-blog/hunting-memory-net-attacks
Click to expand...

Another interesting tidbit. Thanks.

Squiblydoo technique

Log in or Sign up

Fileless Malware CactusTorch Executes Harmful .NET Assemblies From Memory

Minimalist Registered Member

Peter2150 Global Moderator

itman Registered Member

EASTER Registered Member

Log in or Sign up

Fileless Malware CactusTorch Executes Harmful .NET Assemblies From Memory

Minimalist Registered Member

Peter2150 Global Moderator

itman Registered Member

EASTER Registered Member

Useful Searches