Skip to content

Malware

NET-STAR

According to Unit 42, NET-STAR is a .NET malware suite designed to target Internet Information Services (IIS) web servers.

NET-STAR is a Windows malware family.

Background

Unit 42 reports that NET-STAR is a .NET malware suite built to compromise Internet Information Services (IIS) web servers, with its name taken from a string found in the malware's program database (PDB) paths. The suite bundles three separate web-based backdoors that each play a distinct part in the attack chain while sustaining persistence inside the victim's IIS environment: a fileless modular backdoor that can run command-line arguments, arbitrary commands, and payloads entirely in memory; a loader for additional Assemblies; and an enhanced version of that Assembly loader that adds Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass functionality.


Source: Malpedia (Fraunhofer FKIE).