fileless malware

[Shub-Nigurrath]

Hi all
fileless malware are on the rise (see latest Duqu), because thanks to some powershell tricks anyone can write them easily. The learning curve for a fileless malware is now extremely low.
In the past you had to, at least, implement a dll-in-memory loader (I wrote one tutorial about this few years ago, you can find it around "Loading_a_DLL_from_memory_Shub-Nigurrath_v12.rar").

Duqu rise: https://www.schneier.com/blog/archives/2017/02/duqu_malware_te.html

Some frameworks to create similar payloads ...

https://github.com/Genetic-Malware/Ebowla it's a Framework for making Environmental Keyed Payload with reflective DLL, ShellCode, Powershell..
https://github.com/byt3bl33d3r/CrackMapExec its an Opsec safe for pentesting Windows/Active Directory environment ..
https://github.com/n1nj4sec/pupy a RAT written in Python then cross-platform, with a very low footprint
https://github.com/EmpireProject simply a Powershell post-exploitation agent.

Shub