--- title: "Inside .NET Loader Analysis: From Malspam to In-Memory Loader" url: https://daily.dev/posts/inside-net-loader-analysis-from-malspam-to-in-memory-loader-tafajwltg source_url: https://www.huntress.com/blog/malspam-to-loader-delivery-chain-analysis type: article source: "Huntress Blog" published: 2026-06-10T16:42:31.346Z updated: 2026-06-12T14:20:19.810Z tags: [".net", "malware", "powershell"] reading_time: 21 upvotes: 4 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Inside .NET Loader Analysis: From Malspam to In-Memory Loader **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 21 min read · 4 upvotes · 0 comments ## Summary A detailed technical analysis of a five-stage .NET loader infection chain that begins with a malspam email abusing Google's DoubleClick for reputation evasion. The lure uses a personalized phishing kit that dynamically rebrands itself per victim using their email domain. Once executed, a JScript file kicks off a chain through PowerShell and .NET components that performs anti-analysis checks, disables Windows Defender and AMSI/ETW telemetry, establishes NVIDIA-themed persistence via registry Run keys and scheduled tasks, and ultimately injects a final payload into InstallUtil.exe or MSBuild.exe via RunPE process hollowing. The loader communicates over AES-encrypted, protobuf-serialized TCP with certificate pinning, collects hardware fingerprints including GPU details, and supports in-memory injection, PowerShell, and file-drop payload delivery modes. Full IoCs and detection recommendations are included. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns](https://daily.dev/posts/stealth-in-layers-unmasking-the-loader-used-in-targeted-email-campaigns-xfgpoq8c1) · Cyble · 0 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net), [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/inside-net-loader-analysis-from-malspam-to-in-memory-loader-tafajwltg)