.NET

Unpack RedLine stealer using dnSpyEx – Part 3

February 12, 2024

.NET, Config, Debugging, dnSpyEx, Infostealer, Malware Series, RedLine

In this article, we dive into process of unpacking and extracting config from RedLine Stealer using dnSpyEx. It’s a bit lengthy but a great way to learn about the unpacking process using dnSpyEx. 🔍 This is the 3rd part in our deep dive series on RedLine. If you need a…

Unpack RedLine stealer to extract config using pe-sieve -Part 2

February 6, 2024

.NET, dnSpyEx, Infostealer, Malware Series, pe-sieve, ProcMon, RedLine

RedLine Stealer config extraction using two ways: Fast & Easy Method: Use the awesome pe-sieve tool from @hasherezade, which dumps unpacked file from memory. Then, extract the config from dumped file. Using dnSpyEx for manual debugging. It’s a bit lengthy but a great way to learn about the unpacking process.…

AsyncRAT config decryption using CyberChef – Recipe 0x2

August 7, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In the realm of malware analysis, tools like CyberChef play a pivotal role. One of the challenges that malware analysts often face is decrypting configurations of Remote Access Trojans (RATs) like AsyncRAT. This article provides a step-by-step guide on how to decrypt AsyncRAT configurations using CyberChef. Decrypting AsyncRAT ConfigurationsAsyncRAT is…

AsyncRAT: Config Decryption Techniques and Salt Analysis

August 5, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In this article, we dive into the inner workings of AsyncRAT. This Remote Access Trojan (RAT) has seen a staggering 20% surge in its activity during the last quarter, as reported by the Spamhaus report. We’ll explore diverse decryption methods for the AsyncRAT configuration and explore the AES Salts used in…

Converting Integers to Hex with CyberChef – Recipe 0x1

July 14, 2023

.NET, AMSI, AsyncRAT, CyberChef, CyberChef Recipe, RAT

While analyzing malware, it’s common to encounter situations where you need to disassemble code sourced from an integer array. However, when you attempt to use the ‘To Hex’ function in CyberChef, it won’t work. The solution is to employ the ‘To Base’ operation with a radix value of 16. I…