mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Willi Ballenthin
49 lines
1.8 KiB
YAML
49 lines
1.8 KiB
YAML
# generated using capa explorer for IDA Pro
|
|
rule:
|
|
meta:
|
|
name: load Windows Common Language Runtime
|
|
namespace: load-code/dotnet
|
|
authors:
|
|
- michael.hunhoff@mandiant.com
|
|
- blas.kojusner@mandiant.com
|
|
- jakub.jozwiak@mandiant.com
|
|
scopes:
|
|
static: function
|
|
dynamic: call
|
|
references:
|
|
- https://modexp.wordpress.com/2019/05/10/dotnet-loader-shellcode/
|
|
- https://github.com/TheWover/donut/blob/master/loader/inmem_dotnet.c
|
|
examples:
|
|
- 6CD1315F6F2FA4F8EE2B98BB3CA0A994:0x140001030
|
|
features:
|
|
- or:
|
|
- and:
|
|
- description: .NET Framework versions 2.0, 3.0, 3.5
|
|
- or:
|
|
- api: mscoree.CorBindToRuntime
|
|
- api: mscoree.CorBindToRuntimeEx
|
|
- api: mscoree.CorBindToRuntimeHost
|
|
- api: mscoree.CorBindToRuntimeByCfg
|
|
- api: mscoree.CorBindToCurrentRuntime
|
|
- api: ole32.CoCreateInstance
|
|
- and:
|
|
- or:
|
|
- string: "CorBindToRuntime"
|
|
- string: "CorBindToRuntimeEx"
|
|
- string: "CorBindToRuntimeHost"
|
|
- string: "CorBindToRuntimeByCfg"
|
|
- string: "CorBindToCurrentRuntime"
|
|
- string: "CoCreateInstance"
|
|
- match: link function at runtime on Windows
|
|
- bytes: 23 67 2F CB 3A AB D2 11 9C 40 00 C0 4F A3 0A 3E = CLSID_CorRuntimeHost
|
|
- bytes: 22 67 2F CB 3A AB D2 11 9C 40 00 C0 4F A3 0A 3E = IID_ICorRuntimeHost
|
|
- and:
|
|
- description: .NET Framework version 4.x
|
|
- or:
|
|
- api: mscoree.CLRCreateInstance
|
|
- and:
|
|
- string: "CLRCreateInstance"
|
|
- match: link function at runtime on Windows
|
|
- bytes: 8D 18 80 92 8E 0E 67 48 B3 0C 7F A8 38 84 E8 DE = CLSID_CLRMetaHost
|
|
- bytes: 9E DB 32 D3 B3 B9 25 41 82 07 A1 48 84 F5 32 16 = IID_ICLRMetaHost
|