CLR-Stomp

CLR-Stomp is a Beacon Object File (BOF) designed for Cobalt Strike that implements .NET assembly stomping by loading a specified .NET assembly from the Global Assembly Cache (GAC) and replacing its content with a malicious payload before the runtime reads the metadata. This technique offers a covert execution mechanism that retains the legitimate disk identity of the GAC assembly, enabling the payload to evade detection while running in the victim's environment. Notable features include the use of custom memory managers to manipulate the CLR's assembly mapping process and the ability to suppress strong-name verification, which maintains the facade of legitimate assembly usage.