--- title: "NetWalker leverages obfuscated PowerShell to start C# injector" description: NetWalker ransomware was discovered in August 2019 in the wild. It implements a ransomware-as-a-service model, targeting both organizations and individual users. Since March 2020, the operators have managed to extort approximately $25 million. canonical_url: https://www.acronis.com/en/tru/posts/netwalker-leverages-obfuscated-powershell-to-start-c-injector1/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 21 August 2020 # NetWalker leverages obfuscated PowerShell to start C# injector NetWalker ransomware was discovered in August 2019 in the wild. It implements a ransomware-as-a-service model, targeting both organizations and individual users. Since March 2020, the operators have managed to extort approximately $25 million. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** **Summary** * NetWalker was first discovered in August 2019 and has been active ever since * The ransomware not only encrypts, but also steals data to publish it later if the ransom is not paid. * This threat uses an obfuscated PowerShell loader that complicates detection. * NetWalker is a fileless ransomware that uses reflective DLL loading techniques to inject its payload (x86 or x64 DLL) into the ‘explorer.exe’ process. NetWalker ransomware was discovered in August 2019 in the wild. It implements a ransomware-as-a-service model, targeting both organizations and individual users. Since March 2020, the operators have managed to extort approximately $25 million. The distinguishing trait of the recent version of Netwalker is the usage of a heavily obfuscated PowerShell loader to start ransomware on an infected system. **Detection** By using multiple levels of obfuscation, NetWalker is able to escape detection by many antivirus tools: ![Image 1: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/24c2ba69eebdf51f8da0d5075e7e1a00.png) **Infection** To obtain initial access, the attackers typically draw on three techniques: exploitation of web-facing applications, spear-phishing emails with malicious attachments, and the use of comprised accounts that can be bought on the dark web. First, the obfuscated PowerShell loader starts with the execution of a C# injector, which in turn injects the ransomware payload into the ‘explorer.exe’ process. **PowerShell Loader** Netwalker starts a PowerShell script to execute C# code. The ’Add-Type’ cmdlet is used to define a Microsoft .NET Core class in the PowerShell session. ![Image 2: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/7c4dd2326e84d4e6271d03286d4f1782.png) The malicious PowerShell script can then call the native Windows APIs through the Platform Invoke mechanism. ![Image 3: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/189959e72525d29d2d3dac8c7b40f95e.png) ![Image 4: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/f56ef346789230a51618d90002dc7e9d.png) Next, the loader saves the malicious payload specified in the script as byte arrays in the memory. After that, NetWalker determines the CPU architecture; if it is not x64, the loader tries to run the script under PowerShell v.1.0 with additional parameters. ![Image 5: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/73fb0f5f95e30c38feb3ef080a533d98.png) Then, the loader adds a PE header to the stored-in-memory shellcode. ![Image 6: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/d91fc655cfa2f89f0ad55b9500c2c667.png) The PE file starts with ‘ADDEh’ instead of 5A4Dh (‘MZ’) signature — supposedly to avoid attracting the attention of antivirus scanners. ![Image 7: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/c30d28416434c4147dac8e48e01cead8.png) It then stores the obtained PE file with the ransomware payload in the memory of the current process. ![Image 8: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/73870e2c0e55c32319e26affb636d080.png) The loader then makes an attempt to inject the cryptolocker’s code into the ‘explorer.exe’ process. ![Image 9: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/3c33ad5a033143629bc5962196397dd1.png) ![Image 10: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/5efbabe04a4a06e5f8cf881f7843d44e.png) After successful injections, the loader creates and starts a remote thread with the cryptolocker’s code. If the loader fails to inject the NetWalker payload to ‘explorer.exe’, it changes the attributes of the memory page with the ransomware payload to **PAGE_EXECUTE_READWRITE**within the current process. After that, it converts the payload’s entry point to a delegated one and then invokes it. ![Image 11: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/c2e49cc330d989c9cc42f4a39605dcd7.png) **File backup deletion** Similar to many other ransomware variants, NetWalker deletes Windows shadow copies of encrypted files. ![Image 12: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/bc2764194c033f528890301951197c7d.png) **Cryptolocker** The injected code decrypts the addresses of the functions and creates an import address table. Then, it decrypts its configuration data stored as the resource with the name ‘**_31337_**’ (5280 bytes in size) using the RC4 algorithm with a hard-coded key in the resource: ![Image 13: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/3f1269efb4a0fa7bc369c712cbfac7cd.png) NetWalker collects the name of the computer, hardware profile name and UUID, and calculates the hash out of this data. For example: 2AB48C1790809EB4ED5B120FCA449C3E78CB2E31D292D0329ABB51878100E720 It also stores collected information about the infected machine in the Windows system registry:[HKLM\SOFTWARE\<4 first bytes of the UUID hash>] NetWalker kills the following processes in a separate thread to unlock valuable files such as documents and databases: nslsvice.exe pg* nservice.exe cbvscserv* ntrtscan.exe cbservi* hMailServer* IBM* bes10* black* apach* bd2* db* ba* be* QB* oracle* wbengine* vee* postg* sage* sap* b1* fdlaunch* msmdsrv* report* msdtssr* coldfus* cfdot* swag* swstrtr* jetty.exe wrsa.exe team* agent* store.exe sql* sqbcoreservice.exe thunderbird.exe ocssd.exe encsvc.exe excel.exe synctime.exe mspub.exe ocautoupds.exe thebat.exe dbeng50.exe *sql* mydesktopservice.exe onenote.exe outlook.exe powerpnt.exe msaccess.exe tbirdconfig.exe wordpad.exe ocomm.exe dbsnmp.exe thebat64.exe winword.exe oracle.exe xfssvccon.exe firefoxconfig.exe visio.exe mydesktopqos.exe infopath.exe agntsvc.exe NetWalker stops services that start with the following strings: Lotus* veeam* cbvscserv* hMailServer backup* *backup* apach* firebird* ibmiasrw IBM Domino* Simply Accounting Database Connection Manager IASJet QB* *sql* sql* QuickBooksDB* IISADMIN omsad dc*32 server Administrator wbengine mr2kserv MSExchange* ShadowProtectSvc SP*4 teamviewer MMS AcronisAgent ARSM AcrSch2Svc vsnapvss SPXService StorageCraft ImageManager wrsvc stc_endpt_svc acrsch2svc The list of services includes the ones that belong to backup solutions such as Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud), Veeam and any other service that has the ‘_backup_’ string in its name. It can’t actually disable the Acronis service due to robust self-defense mechanisms implemented in the product, but it can shut down other backup solutions —after that, it’s game over for victims unless they have backups at another location. After that, it starts encrypting the victim’s files on local, removable and network-attached drives. However, files and folders that contain the following strings are ignored: *system volume information *windows.old *:\users\*\*temp *msocache *:\winnt *$windows.~ws *perflogs *boot *:\windows *:\program file*\vmware \\*\users\*\*temp \\*\winnt \\*\windows *\program file*\vmware *appdata*microsoft *appdata*packages *microsoft\provisioning *dvd maker *Internet Explorer *Mozilla *Mozilla* *Old Firefox data *\program file*\windows media* *\program file*\windows portable* *windows defender *\program file*\windows nt *\program file*\windows photo* *\program file*\windows side* *\program file*\windowspowershell *\program file*\cuass* *\program file*\microsoft games *\program file*\common files\system *\program file*\common files\*shared *\program file*\common files\reference ass* *\windows\cache* *temporary internet* *media player *:\users\*\appdata\*\microsoft \\*\users\*\appdata\*\microsoft *\Program File*\Cisco The following specific files are skipped: ntuser.dat* boot.ini ntldr iconcache.db bootmgr thumbs.db gdipfont*.dat bootnxt bootsect.bak ntuser.ini desktop.ini bootfont.bin usrclass.dat ntuser.dat userclass.dat autorun.inf As are files with the following extensions: msp msc mui exe mod regtrans-ms sys clb theme hta idx 386 shs ps1 wpx nomedia mpa ani diagpkg cpl prf cab icl rtp ics msu ldf msstyles msi key cur nls diagcab drv scr cmd icns adv spl dll com deskthemepack ocx hlp bat lnk rom themepack In every folder with encrypted files, NetWalker creates a text file (_<3 first bytes of the UUID hash>-Readme.txt_) containing the following ransom note: ![Image 14: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/9ad62158acd951fb5b5c47e82f06085e.png) **Decryption service** After clicking on the link, we get to the decryption service of the attackers on the Tor network. On the main page, we are asked to enter a code to access our "personal account." ![Image 15: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/93143d7462f9cceb659c1cdfcba604f4.png) We enter the code: ![Image 16: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/266a59bc214635432ebbaf17ca03995d.png) And we are told to pay a ransom within seven days in the amount of 0.2197 BTC ($2,500 at the time of writing); after seven days, the price will double: ![Image 17: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/597ad1fd06df1049a04529a3f4305dec.png) The user can run a test decryption of their files: ![Image 18: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/e8985e7c417aabf4c52ea9f18f738fbd.png) There are also ‘Chat’ and ‘FAQ’ pages. On the ‘Blog’ page, you can see the results of a recent attack. When decrypting files, NetWalker ignores the files that have the following strings in paths: *:\windows* *:\winnt* *:\program file*\vmwar* *\Program File*\Fortinet \Program File*\Cisco And file names: psexec.exe system forti*.exe fmon.exe fcaptmon.exe FCHelper64.exe **Detection by Acronis****Cyber Platform (formerly Acronis Cyber Protect Cloud)** Despite NetWalker’s attempt to shut down backup services, Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) is equipped with self-defense functionality that blocks the ransomware activity and successfully restores encrypted files. ![Image 19: NetWalker leverages obfuscated PowerShell to start C# injector](https://staticfiles.acronis.com/images/content/206f97dee6488b7a9cd294d20ff3177e.png) **IoCs** SHA256: 3f41f3be6770160a8972601ad6da6c36b1f75676aaa81c4edf492d43b94d1da5 Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)