Inside .NET Loader Analysis: From Malspam to In-Memory Loader

A Huntress Labs technical analysis describes a malspam campaign that routes victims through DoubleClick to a dynamic malspam kit which personalizes lures, delivering a ZIP containing a heavily obfuscated JScript loader that spawns staged PowerShell and a .NET loader. The multi-stage chain performs extensive anti-analysis checks, disables and excludes Microsoft Defender, patches AMSI/ETW, performs reflective .NET loads and RunPE process hollowing into MSBuild/InstallUtil, establishes persistence via Run/RunOnce and scheduled tasks, communicates with AES/RSA-protected C2, and provides operator-configurable payload delivery modes; the report includes IoCs and recommended mitigations.