https://github.com/bigbuildbench/dr4k0nia_niximports
Science Score: 13.0%
This score indicates how likely this project is to be science-related based on various indicators:
-
○CITATION.cff file
-
✓codemeta.json file
Found codemeta.json file -
○.zenodo.json file
-
○DOI references
-
○Academic publication links
-
○Academic email domains
-
○Institutional organization owner
-
○JOSS paper metadata
-
○Scientific vocabulary similarity
Low similarity (8.7%) to scientific vocabulary
Repository
Basic Info
- Host: GitHub
- Owner: BigBuildBench
- License: mit
- Language: C#
- Default Branch: master
- Size: 12.7 KB
Statistics
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
- Releases: 0
Metadata Files
README.md
NixImports
A .NET malware loader, using API-Hashing and dynamic invoking to evade static analysis
How does it work?
NixImports uses my managed API-Hashing implementation HInvoke, to dynamically resolve most of it's called functions at runtime. To resolve the functions HInvoke requires two hashes the typeHash and the methodHash. These hashes represent the type name and the methods FullName, on runtime HInvoke parses the entire mscorlib to find the matching type and method. Due to this process, HInvoke does not leave any import references to the methods called trough it.
Another interesting feature of NixImports is that it avoids calling known methods as much as possible, whenever applicable NixImports uses internal methods instead of their wrappers. By using internal methods only we can evade basic hooks and monitoring employed by some security tools.
For a more detailed explanation checkout my blog post.
You can generate hashes for HInvoke using this tool
How to use
NixImports only requires a filepath to the .NET binary you want to pack with it.
NixImports.exe <filepath>
It will automatically generate a new executable called Loader.exe in it's root folder. The loader executable will contain your encoded payload and the stub code required to run it.
Tips for Defenders
If youre interested in detection engineering and possible detection of NixImports, checkout the last section of my blog post
Or click here for a basic yara rule covering NixImports.
Owner
- Name: BigBuildBench
- Login: BigBuildBench
- Kind: organization
- Repositories: 1
- Profile: https://github.com/BigBuildBench
abbr. B3, benchmarking the repo-level understanding capability of your LLMs by reconstructing project build-file.
GitHub Events
Total
- Create event: 6
Last Year
- Create event: 6
Dependencies
- actions/checkout v3 composite
- actions/setup-dotnet v3 composite