---
id: 6074
title: "Malware development part 9 - hosting CLR and managed code injection"
source_domain: 0xpat.github.io
source_url: "https://0xpat.github.io/Malware_development_part_9/"
published_at: "2021-06-17T00:00:00Z"
tags: ["red-team", "dotnet", "code-injection", "malware-development", "clr-hosting", "managed-code"]
phying_url: "https://phying.com/item/6074"
lang: en
---

# Malware development part 9 - hosting CLR and managed code injection

## Summary

Malware development part 9: executing managed .NET assemblies from native code—hosting the CLR via ICLRRuntimeHost/ICorRuntimeHost, and running payloads from memory rather than disk.

## Intelligence Metadata

- **Sources:** 0xpat.github.io
- **Published:** 2021-06-17T00:00:00Z
- **Original:** https://0xpat.github.io/Malware_development_part_9/
- **Phying News:** https://phying.com/item/6074