Malware Analysis - Agniane Stealer, Native Stub to .NET Unpacking
Channel: MalwareAnalysisForHedgehogs
Date: 2023-08-19

We trace API calls of a packed native file using hasherezade's tiny_tracer and discover that it unpacks a .NET payload. Using x64dbg we unpack the .NET assembly and find it unreadable, among others due to dr4k0nia's XOR string obfuscation.

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Sample: https://bazaar.abuse.ch/sample/63af1bc6256086131314311b5908c85399b95dda6c4c6e84c8d77bd1b4d1fc43

tiny_tracer: https://github.com/hasherezade/tiny_tracer
PortexAnalyzerGUI: https://github.com/struppigel/PortexAnalyzerGUI/releases/tag/0.12.12
x64dbg: https://help.x64dbg.com/en/latest/
de4dot: https://github.com/de4dot/de4dot
dnSpy: https://github.com/dnSpyEx/dnSpy

00:00 Intro
00:35 Triage - strings, DiE and PortexAnalyzer
03:20 API logging with tiny_tracer
05:09 Dumping with x64dbg
08:45 Unmapping with pe_unmapper
10:42 Deobfuscation of payload with de4dot
12:50 Marking up some code

#malware #malwareanalysis #reverseengineering #stealer #dotnet #unpacking