Malware Analysis - Unpacking njRAT Protected by Confuser v.1.9 and others
Channel: MalwareAnalysisForHedgehogs
Date: 2016-08-05

Unpacking and deobfuscation of .NET malware protected by Confuser v.1.9, Babel .NET, RPX and a custom dropper with Base64. The final payload is njRAT 0.7d aka Bladabindi.

Thanks to @malwrhunterteam for the sample and detailed help.
Thanks to @F_kZ_ for support as well.
You might want to follow these great guys on Twitter.

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Sample: https://www.hybrid-analysis.com/sample/f7a418dbb9d7608ac8c4dea21c15005b859d5b1c090e04ac7437ad24964ab0f6?environmentId=100

Article about netmodule: https://blogs.msdn.microsoft.com/junfeng/2005/02/12/netmodule-vs-assembly/

DnSpy: https://github.com/0xd4d/dnSpy/releases
CFF Explorer: http://www.ntcore.com/exsuite.php
ILSpy: http://ilspy.net/
de4dot: https://github.com/0xd4d/de4dot/releases
PEStudio: https://winitor.com/
MegaDumper: https://forum.tuts4you.com/topic/31899-unpackers-tools-source-code-c/
NoFuser: http://hackforums.net/showthread.php?tid=3581893 (be careful with this source, I don't know where else you would get it)