ReversingLabs @reversinglabs.com · Nov 21 It uses an #npm package "electron-edge-js" to execute inline .NET code. This method has previously been seen & discussed by Check Point, where #malware authors embedded the shellcode inside the CSharp code itself: blog.checkpoint.com/securing-the...
0 likes 1 replies
?
Replies
This time, the malicious C# code downloads an "icon" from a remote server, copies its binary content to newly allocated memory with execute permissions & executes it. This is textbook shellcode injection. The code in the picture has been modified in order to fit the whole logic.