{
  "family": "dotnet",
  "sample_count": 6,
  "category": "ransomware",
  "description": "Trojan:MSIL/Dotnet (or Generic.DotNet) is a broad, generic heuristic detection utilized by antivirus engines to flag highly suspicious or demonstrably malicious executable files that have been compiled using the Microsoft .NET framework (C#, VB.NET, F#). Because .NET code compiles to Intermediate Language (MSIL) rather than native machine code, it is exceptionally easy for malware authors to write, obfuscate, and iterate upon. This generic detection acts as a catch-all for newly compiled, unpackaged .NET malware that does not yet have a specific family signature.<br><br><b>Understanding the Dotnet Heuristic</b><br>To an end-user, an alert for 'Dotnet' simply means a virus was blocked. For a SOC analyst, this detection indicates the presence of a custom-written tool or a heavily obfuscated variant of known .NET malware (like Agent Tesla, AsyncRAT, or QuasarRAT). Malware authors heavily favor .NET because the framework provides built-in libraries for cryptography, network communication, and system interaction, drastically reducing development time.<br><br><b>Execution and Evasion Mechanics</b><br>Malicious .NET assemblies are typically delivered via phishing campaigns, often masquerading as legitimate installers or document viewers (`T1566.001`). Because MSIL can be easily decompiled using tools like dnSpy or ILSpy, threat actors rely heavily on advanced obfuscators (like ConfuserEx, SmartAssembly, or custom packers) (`T1027`). These obfuscators mangle class names, encrypt strings, and implement control flow flattening to confuse heuristic engines and human analysts. Upon execution (`T1204.002`), the .NET malware often utilizes 'Process Hollowing' or 'Reflection' (`T1055`) to inject its unencrypted payload directly into the memory of a legitimate Windows process (like `RegAsm.exe` or `MSBuild.exe`), bypassing static disk analysis.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the specific payload hidden within the generic .NET dropper (it could be ransomware, an infostealer, or a RAT). Host-based IoCs include EDR alerts for `.exe` files executing from the `%Temp%` or `%AppData%` directories, particularly if they immediately spawn native Windows utilities like `RegAsm.exe` (a strong indicator of process injection).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Dotnet and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dotnet is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dotnet establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dotnet typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Dotnet compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Dotnet should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Dotnet employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dotnet typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Dotnet, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Dotnet depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1566.001",
    "T1204.002",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Use of .NET Obfuscators)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Often injecting into RegAsm.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately, as the generic nature of the detection means the exact capability of the malware is unknown.",
    "Use an enterprise EDR solution to trace the process execution tree to determine what the .NET assembly actually *did* (e.g., did it drop files, alter the registry, or open network connections?).",
    "Collect the malicious `.exe` and submit it to a sandbox (like Any.Run or Hybrid Analysis) for dynamic analysis to identify its true family and C2 infrastructure.",
    "Ensure the endpoint has the latest Microsoft .NET Framework security patches installed."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor just because the detection name is generic; 'Dotnet' detections frequently mask sophisticated InfoStealers and RATs.",
    "Avoid relying purely on static analysis; heavily obfuscated .NET malware must often be executed in a controlled sandbox to reveal its true payload."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}