> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials.md).

# Malware Essentials

The 'implant/agent' of most C2 frameworks are written as Windows DLLs. However, DLLs are designed to run from disk, which is unsuitable or undesirable in many scenarios. \
\
These DLLs are therefore paired with a 'loader', which is responsible for loading a DLL from memory (rather than of from disk), in a manner that's compatible with the operating system. \
\
This Loader + DLL combination is output from the framework as shellcode (.bin file). Shellcode doesn't really 'run' by itself, so must be injected into memory and (typically) a new threat created to execute it.

Most frameworks are also capable of producing 'ready-to-run' payloads in formats such as .exe, .dll, and .ps1 files. These are made by taking the aforementioned shellcode (loader + DLL) and embedding it a 'shellcode runner', implemented in these various formats.

This is not a malware development course, so we won't be covering how these DLL loaders work under the hood. The aim of this chapter is to proivde you with a foundation for understanduing the PE file structure, processes, and how a few injection techniques are performed.

### PE file