Dotnet

After nine stages of obfuscation, the final payload reveals itself as PureRAT, a commercial .NET RAT using TLS-pinned C2, Protocol Buffers, and modular plugins for remote access and control.

Advanced .NET loader dynamically loads assemblies from memory, decrypts payloads on-the-fly, and invokes methods without touching disk, requiring a pivot from static to dynamic analysis techniques.

The campaign shifts from Python to compiled .NET executables using process hollowing for in-memory PE injection, AMSI patching, and ETW unhooking to evade detection and establish persistence.