Dotnet

Overview

Trojan:MSIL/Dotnet (or Generic.DotNet) is a broad, generic heuristic detection utilized by antivirus engines to flag highly suspicious or demonstrably malicious executable files that have been compiled using the Microsoft .NET framework (C#, VB.NET, F#). Because .NET code compiles to Intermediate Language (MSIL) rather than native machine code, it is exceptionally easy for malware authors to write, obfuscate, and iterate upon. This generic detection acts as a catch-all for newly compiled, unpackaged .NET malware that does not yet have a specific family signature.

Understanding the Dotnet Heuristic
To an end-user, an alert for 'Dotnet' simply means a virus was blocked. For a SOC analyst, this detection indicates the presence of a custom-written tool or a heavily obfuscated variant of known .NET malware (like Agent Tesla, AsyncRAT, or QuasarRAT). Malware authors heavily favor .NET because the framework provides built-in libraries for cryptography, network communication, and system interaction, drastically reducing development time.

Execution and Evasion Mechanics
Malicious .NET assemblies are typically delivered via phishing campaigns, often masquerading as legitimate installers or document viewers (`T1566.001`). Because MSIL can be easily decompiled using tools like dnSpy or ILSpy, threat actors rely heavily on advanced obfuscators (like ConfuserEx, SmartAssembly, or custom packers) (`T1027`). These obfuscators mangle class names, encrypt strings, and implement control flow flattening to confuse heuristic engines and human analysts. Upon execution (`T1204.002`), the .NET malware often utilizes 'Process Hollowing' or 'Reflection' (`T1055`) to inject its unencrypted payload directly into the memory of a legitimate Windows process (like `RegAsm.exe` or `MSBuild.exe`), bypassing static disk analysis.

Indicators of Compromise & Impact
The impact depends entirely on the specific payload hidden within the generic .NET dropper (it could be ransomware, an infostealer, or a RAT). Host-based IoCs include EDR alerts for `.exe` files executing from the `%Temp%` or `%AppData%` directories, particularly if they immediately spawn native Windows utilities like `RegAsm.exe` (a strong indicator of process injection).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_DOTNET_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dotnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "dotnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Dotnet (Ransomware) Execution & Triage
id: 7b1582ad-6f25-5893-b82b-6bff1d06d241
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Dotnet malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/dotnet
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1027
- attack.t1566_001
- attack.t1204_002
- attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_DOTNET_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dotnet tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "dotnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network immediately, as the generic nature of the detection means the exact capability of the malware is unknown.
2. Use an enterprise EDR solution to trace the process execution tree to determine what the .NET assembly actually *did* (e.g., did it drop files, alter the registry, or open network connections?).
3. Collect the malicious `.exe` and submit it to a sandbox (like Any.Run or Hybrid Analysis) for dynamic analysis to identify its true family and C2 infrastructure.
4. Ensure the endpoint has the latest Microsoft .NET Framework security patches installed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is minor just because the detection name is generic; 'Dotnet' detections frequently mask sophisticated InfoStealers and RATs.
2. Avoid relying purely on static analysis; heavily obfuscated .NET malware must often be executed in a controlled sandbox to reveal its true payload.

References & External Analysis

• Search "dotnet" on VirusTotal (External Analysis)
• Search "dotnet" on Any.Run (Sandbox Sandbox)
• Search "dotnet" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Inrogatio
• Boychi
• Penzievs
• Antavmu
• Smartassembly
• Woripecs
• Zonobindi
• Zmem

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/dotnet.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.