Fileless malware CactusTorch is using DotNetToJScript to execute harmful .NET assemblies from memory.
On July 26, researchers at McAfee Labs reported that they compiled the tool and uncovered the .NET executable DotNetToJScript.exe. The executable accepts a .NET assembly responsible for creating a new suspended process, allocating memory, writing shellcode in the target’s memory process and creating a thread to execute the shellcode.
DotNetToJScript does not ship out with CactusTorch. It ultimately yields only a JavaScript file containing the .NET assembly. The script host (wscript.exe) executes the JavaScript file on a target system.
Fileless Malware on the Rise
McAfee Labs observed a significant increase in CactusTorch between 2017 and 2018. Researchers detected just one or two variants of the malware back in April 2017. Fourteen months later, they documented close to 35 variants — all of which are capable of executing shellcode on Windows machines.
...
......
