Skip to main content
Mallory
MalwareUsed by 1 actorExploits 2 CVEs

NET-STAR

NET-STAR is a previously undocumented .NET malware suite designed to target Microsoft Internet Information Services (IIS) web servers. It has been attributed in reporting to the China-aligned espionage actor Phantom Taurus, which has used it in campaigns against government and telecommunications organizations across Africa, the Middle East, and Asia, with targeting focused on ministries of foreign affairs, embassies, diplomatic communications, defense-related intelligence, and other high-value government operations.

The suite consists of three distinct web-based backdoors: IIServerCore, AssemblyExecuter v1, and AssemblyExecuter v2. IIServerCore is described as a fileless modular backdoor that runs entirely in memory inside the IIS worker process w3wp.exe. It is loaded by an ASPX web shell named OutlookEN.aspx containing an embedded Base64-compressed IIServerCore binary. Reported capabilities include encrypted AES-based command-and-control, cookie-based session handling, in-memory loading of Base64-encoded .NET assemblies, arbitrary command and payload execution, file operations, database access including execution of SQL commands, web shell management, and security evasion. AssemblyExecuter v1 and v2 are in-memory .NET loaders used to execute arbitrary .NET assemblies via Assembly.Load() without writing them to disk; AssemblyExecuter v2 additionally includes AMSI and ETW bypass capabilities.

NET-STAR emphasizes stealth and anti-forensics. Reporting states Phantom Taurus timestomped the OutlookEN.aspx web shell and NET-STAR components and altered compilation times to random future dates. IIServerCore includes a command named changeLastModified, indicating active timestomping capability. The malware is described as difficult to detect because of its memory-resident, fileless design and its use of evasion features intended to impair security monitoring.

High-confidence indicators mentioned in the content include the following SHA-256 hashes associated with NET-STAR components: ServerCore.dll eeed5530fa1cdeb69398dc058aaa01160eab15d4dcdcd6cb841240987db284dc; ExecuteAssembly.dll variants 3e55bf8ecaeec65871e6fca4cb2d4ff2586f83a20c12977858348492d2d0dec4, afcb6289a4ef48bf23bab16c0266f765fab8353d5e1b673bd6e39b315f83676e, and b76e243cf1886bd0e2357cbc7e1d2812c2c0ecc5068e61d681e0d5cff5b8e038.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES
CVE-2021-26855ProxyLogon SSRF in Microsoft Exchange Server

"...a never-before-seen bespoke malware suite dubbed NET-STAR. Developed in .NET, the program is designed to target Internet Information Services (IIS) web servers."

via the hacker newsthehackernews.com
CVE-2021-34473ProxyShell pre-auth SSRF/authentication bypass in Microsoft Exchange Autodiscover

"...a never-before-seen bespoke malware suite dubbed NET-STAR. Developed in .NET, the program is designed to target Internet Information Services (IIS) web servers."

via the hacker newsthehackernews.com
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Phantom Taurus

Phantom Taurus uses multiple pieces of malware, including the newly identified NET-STAR malware suite, which consists of three distinct web-based backdoors.

via cyberscoopcyberscoop.com
MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1
TacticExecution

These backdoors support in-memory execution of command-line arguments, arbitrary commands and payloads...

T1106Native APIEvidence1
TacticExecution

...and the loading and execution of .NET payloads with evasive capabilities designed to avoid detection in more heavily monitored environments...

Persistence

1 technique
T1505.003Web ShellEvidence1

Phantom Taurus uses multiple pieces of malware, including the newly identified NET-STAR malware suite, which consists of three distinct web-based backdoors.

Stealth

1 technique
T1620Reflective Code LoadingEvidence1
TacticStealth

These backdoors support in-memory execution of command-line arguments, arbitrary commands and payloads...

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app8 months ago
hash.sha256●●●●●●●●●●●●View more in app8 months ago
hash.sha256●●●●●●●●●●●●View more in app8 months ago
hash.sha256●●●●●●●●●●●●View more in app8 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.