Locked NixImports - A .NET Malware Loader

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

A .NET malware loader, using API-Hashing and dynamic invoking to evade static analysis.

How does it work?

NixImports uses my managed API-Hashing implementation HInvoke, to dynamically resolve most of it's called functions at runtime. To resolve the functions HInvoke requires two hashes the typeHash and the methodHash. These hashes represent the type name and the methods FullName, on runtime HInvoke parses the entire mscorlib to find the matching type and method. Due to this process, HInvoke does not leave any import references to the methods called trough it.

Another interesting feature of NixImports is that it avoids calling known methods as much as possible, whenever applicable NixImports uses internal methods instead of their wrappers. By using internal methods only we can evade basic hooks and monitoring employed by some security tools.

This is the hidden content, please

• Sign In
• or
• Sign Up