Dotnet

Overview

Trojan:MSIL/Dotnet (or Generic.DotNet) is a broad, generic heuristic detection utilized by antivirus engines to flag highly suspicious or demonstrably malicious executable files that have been compiled using the Microsoft .NET framework (C#, VB.NET, F#). Because .NET code compiles to Intermediate Language (MSIL) rather than native machine code, it is exceptionally easy for malware authors to write, obfuscate, and iterate upon. This generic detection acts as a catch-all for newly compiled, unpackaged .NET malware that does not yet have a specific family signature.

Understanding the Dotnet Heuristic
To an end-user, an alert for 'Dotnet' simply means a virus was blocked. For a SOC analyst, this detection indicates the presence of a custom-written tool or a heavily obfuscated variant of known .NET malware (like Agent Tesla, AsyncRAT, or QuasarRAT). Malware authors heavily favor .NET because the framework provides built-in libraries for cryptography, network communication, and system interaction, drastically reducing development time.

Execution and Evasion Mechanics
Malicious .NET assemblies are typically delivered via phishing campaigns, often masquerading as legitimate installers or document viewers (`T1566.001`). Because MSIL can be easily decompiled using tools like dnSpy or ILSpy, threat actors rely heavily on advanced obfuscators (like ConfuserEx, SmartAssembly, or custom packers) (`T1027`). These obfuscators mangle class names, encrypt strings, and implement control flow flattening to confuse heuristic engines and human analysts. Upon execution (`T1204.002`), the .NET malware often utilizes 'Process Hollowing' or 'Reflection' (`T1055`) to inject its unencrypted payload directly into the memory of a legitimate Windows process (like `RegAsm.exe` or `MSBuild.exe`), bypassing static disk analysis.

Indicators of Compromise & Impact
The impact depends entirely on the specific payload hidden within the generic .NET dropper (it could be ransomware, an infostealer, or a RAT). Host-based IoCs include EDR alerts for `.exe` files executing from the `%Temp%` or `%AppData%` directories, particularly if they immediately spawn native Windows utilities like `RegAsm.exe` (a strong indicator of process injection).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DOTNET {
    meta:
        description = "Detects Dotnet (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "dotnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Dotnet Activity
id: 85c69322756e01fd4a7a22de55e19743
status: experimental
description: Detects generic indicators of the dotnet malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*dotnet*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network immediately, as the generic nature of the detection means the exact capability of the malware is unknown.
2. Use an enterprise EDR solution to trace the process execution tree to determine what the .NET assembly actually *did* (e.g., did it drop files, alter the registry, or open network connections?).
3. Collect the malicious `.exe` and submit it to a sandbox (like Any.Run or Hybrid Analysis) for dynamic analysis to identify its true family and C2 infrastructure.
4. Ensure the endpoint has the latest Microsoft .NET Framework security patches installed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is minor just because the detection name is generic; 'Dotnet' detections frequently mask sophisticated InfoStealers and RATs.
2. Avoid relying purely on static analysis; heavily obfuscated .NET malware must often be executed in a controlled sandbox to reveal its true payload.

References & External Analysis

• Search "dotnet" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Uloader
• Fugrafa
• Avkiller
• Scarab
• Genericrxcs

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/dotnet.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.