One of the malicious executables recently delivered by RIG Exploit Kit includes similar features as one we described some time ago. The payload can be injected into one of the predefined executables: vbc.exe, RegAsm.exe or AppLaunch.exe. The real payload is hidden inside of another encrypted resource. We were able to reconstruct a sample decoder, you can find the python script here: msil_dec.py. The decryption key is included in the parameters that are decrypted.”]
Source: https://blog.malwarebytes.com/threat-analysis/2016/07/unpacking-yet-another-net-crypter/