net-assembly-dropper

A proof of concept file dropper utilizing PowerShell loosely based off of https://github.com/ch2sh/Jlaive

note: only works with .NET assemblies due to use of Assembly.Load

Results:

before: generic reverse tcp shell off github (https://github.com/ihack4falafel/ReverseShell)

after:

Usage:

Replace "C:\Users\Desktop\File.exe" with the path to your file and build the project in release mode. The resulting binary will have your original file embedded and AES encrypted.

Todo:

• Reduce binary size
• DInvoke AMSI bypass: https://github.com/Kudaes/DInvoke_rs
• Rewrite powershell builder and add "-ExecutionPolicy Bypass" flag
• Implement anti-vm techniques
• Native support