Deobfuscate strings using De4dot https://github.com/0xd4d/de4dot
d4dot.exe -strtyp delegate -strtok <deobfuscation function token> <file>
d4dot.exe -strtyp delegate -strtok <deobfuscation function token> <file>
GitHub
GitHub - de4dot/de4dot: .NET deobfuscator and unpacker.
.NET deobfuscator and unpacker. Contribute to de4dot/de4dot development by creating an account on GitHub.
https://youtu.be/1RNcZpBLZHs
Manual unpacking using dnspy and class constructor ( .cctor )
Note. No need actually for using ilspy you can modify the entry point by editing module settings:
Right click on it in modules tree
Edit module
Choose mananged
Choose the main method
Save module
Manual unpacking using dnspy and class constructor ( .cctor )
Note. No need actually for using ilspy you can modify the entry point by editing module settings:
Right click on it in modules tree
Edit module
Choose mananged
Choose the main method
Save module
YouTube
Malware Analysis - When De4dot fails, Removing Anti Tamper from NullShield
Decompilation fails and de4dot cannot deobfuscate this trojan spy named Evrial. We discover code in the module's constructor (.cctor) that fixes the assembly.
Malware analysis courses: https://malwareanalysis-for-hedgehogs.learnworlds.com/courses
Buy me…
Malware analysis courses: https://malwareanalysis-for-hedgehogs.learnworlds.com/courses
Buy me…
Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques
https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
Screenshot at 2019-02-22 23-09-07.png
164.3 KB
Why still using GDB ?
Sandbox for semi-automatic Javanoscript malware analysis, deobfuscation and payload extraction. Written for Node.js
https://github.com/HynekPetrak/malware-jail
https://github.com/HynekPetrak/malware-jail
GitHub
GitHub - HynekPetrak/malware-jail: Sandbox for semi-automatic Javanoscript malware analysis, deobfuscation and payload extraction.…
Sandbox for semi-automatic Javanoscript malware analysis, deobfuscation and payload extraction. Written for Node.js - HynekPetrak/malware-jail