Fileless Malware Loader (PowerShell)

PowerShell Fileless Loader — In-Memory Execution

PowerShell loader that downloads and executes payloads entirely in memory: nothing touches disk. v2.1 fixed the AMSI patch for 32-bit PowerShell and completed the native PE mapping engine.

• Download cradles: IEX(IWR), Net.WebClient, HttpClient with automatic fallback chain.
• AMSI bypass: AmsiScanBuffer patch with architecture-correct stubs — x86 uses ret 16 (stdcall cleanup), x64 uses ret; the right stub is selected at runtime.
• .NET assembly execution: [Assembly]::Load() from byte array.
• Shellcode runner: VirtualAlloc + Marshal.Copy + CreateThread.
• Reflective PE: manual mapping with base relocation application (HIGHLOW/DIR64), import directory resolution (name and ordinal thunks), per-section memory protection (R/RW/RX) and a PE Machine check against the PowerShell process.
• Obfuscation: dynamic string construction, no hardcoded signatures.

Known limits (documented): TLS callbacks are not re-run; sections mapped at the preferred base skip relocation.