.NET / Managed Malware

• A huge fraction of commodity malware is written in C# / .NET: stealers, loaders, RATs, ransomware.
• Why attackers love it:
• Fast to write, rich standard library (networking, crypto, reflection).
• Reflection enables in-memory loading — run a payload without touching disk.
• Plenty of free source and builders to copy from.
• .NET does not compile to native code. It compiles to MSIL / CIL (Microsoft Intermediate Language / Common Intermediate Language) inside a PE "assembly."
• The CLR (Common Language Runtime) JIT-compiles IL to native at runtime.
• Good news for us: IL carries rich metadata (type names, method names, strings) — it decompiles back to near-source C#.