mrmoor/cyber-threat-intelligence huggingface dataset:
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  32a3934d96a8f2dae805fa28355cd0155c22ffad4545f9cd9c1ba1e9545b39ac
test.exe  BIOPASS RAT Loader  Backdoor.
32c1460ba5707783f1bbaedab5e5eab21d762094106d6af8fa6b2f0f0d777c1a
test3.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  344cdbc2a7e0908cb6638bc7b81b6b697b32755bad3bed09c511866eff3876c7
test4.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  3589e53c59d9807cca709387bbcaaffc7e24e15d9a78425b717fc55c779b928e
flash.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  36e3fcd6a4c7c9db985be77ea6394b2ed019332fdae4739df2f96a541ea52617  Silverlight.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  3e8f8b8a5f70c195a2e4d4fc7f80523809f6dbf9ead061ce8ef04fb489a577cf  test-flash.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba  flash_installer.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  5fd2da648068f75a4a66b08d6d93793f735be62ae88085a79d839b6a0d6d859a  flash1.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  660cef8210f823acb0b31d78fbce1d6f3f8c4f43231286f7ac69f75b2c42c020  flashplayerpp_install_cn.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  69d930050b2445937ec6a4f9887296928bf663f7a71132676be3f112e80fe275  test.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  6a0976e5f9d07ff3d80fa2958976183758ba5fcdd4645e391614a347b4b8e64b  f0b96efe2f714e7bddf76cc90a8b8c88_se.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  6ee8f6a0c514a5bd25f7a32210f4b3fe878d9d417a7ebe07befc285131bae10e  news.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  75e03f40a088903579a436c0d8e8bc3d0d71cf2942ad793cc948f36866a2e1ad  silverlight_ins.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  7d0d7d416db5bd7201420982987e213a129eef2314193e4558a24f3c9a91a38e  flash_installer.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0  Silverlight.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  8445c0189735766edf0e3d01b91f6f98563fef272ac5c92d3701a1174ad072dd  Silverlight_ins.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  89c0b2036ce8d1d91f6d8b8171219aafcd6237c811770fa16edf922cedfecc54  MTYwOTI1MzEzNQ==.exe  BIOPASS RAT Loader  Backdoor.
8b5d4840bbdce0798950cd5584e3d4564581a7698bc6cfb2892c97b826129cec  Silverlight_ins.exe
932B45AB117960390324678B0696EF0E07D7F8DE1FA0B94C529F243610F1DCC9
flash_ins.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  98a91356e0094c96d81bd27af407dd48c3c91aaf97da6794aeb303597a773749  Silverlight1.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9eed9a2e0edf38f6354f4e57b3a6b9bed5b19263f54bcee19e66fc8af0c29e4e  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9f34d28562e7e1e3721bbf679c58aa8f5898995ed999a641f26de120f3a42cf4  Silverlight1.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9ff906ffcde32e4c6fb3ea4652e6d6326713a7fde8bb783b52f12a1f382f8798  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  a7c4dac7176e291bd2aba860e1aa301fb5f7d880794f493f2dea0982e2b7eb31  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b48e01ff816f12125f9f4cfc9180d534c7c57ef4ee50c0ebbe445e88d4ade939  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b82bde3fe5ee900a76ac27b4869ed9aa0802c63bbd72b3bfb0f1abce6340cc6c  Silverlight_ins.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b9d0838be8952ebd4218c8f548ce94901f789ec1e32f5eaf46733f0c94c77999  Silverlight_ins.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  ba44c22a3224c3a201202b69d86df2a78f0cd1d4ac1119eb29cae33f09027a9a  Silverlight2.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975  Silverlight.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  bf4f50979b7b29f2b6d192630b8d7b76adb9cb65157a1c70924a47bf519c4edd  test.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c11906210465045a54a5de1053ce0624308a8c7b342bb707a24e534ca662dc89  test-flash.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  c3fa69e15a63b151f8d1dc3018284e153ad2eb672d54555eaeaac79396b64e3b  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5  flashplayerpp_install_cn.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c8542bffc7a2074b8d84c4de5f18e3c8ced30b1f6edc13047ce99794b388285c  flash2.exe  BIOPASS RAT Loader  Backdoor.
cce6b17084a996e2373aaebbace944a17d3e3745e9d88efad4947840ae92fd55
Silverlight_ins.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  d18d84d32a340d20ab07a36f9e4b959495ecd88d7b0e9799399fcc4e959f536b  flash_installer.exe
e4109875e84b3e9952ef362abc5b826c003b3d0b1b06d530832359906b0b8831
flash.exe  BIOPASS RAT Loader
Backdoor.Win64.BIOPASS.A  e52ea54cfe3afd93a53e368245c5630425e326291bf1b2599b75dbf8e75b7aeb  flashplayer_install_cn.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  f1ad25b594a855a3c9af75c5da74b44d900f6fbb655033f9a98a956292011c8e  Silverlight.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  fa1d70b6b5b1a5e478c7d9d840aae0cc23d80476d9eea884a73d1b7e3926a209  64.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  fa7fbca583b22d92ae6d832d90ee637cc6ac840203cd059c6582298beb955aee  test.exe  BIOPASS RAT Loader  Backdoor.
fb770a3815c9ebcf1ba46b75b8f3686acc1af903de30c43bab8b86e5b46de851
test4.exe  BIOPASS RAT Loader
Backdoor.
fb812a2ccdab0a9703e8e4e12c479ff809a72899374c1abf06aef55abbbf8edc
flash_installer.exe  BIOPASS RAT Loader  Backdoor.
ee2e9a1d3b593fd464f885b734d469d047cdb1bc879e568e7c33d786e8d1e8e2
aos.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  afbfe16cbdd574d64c24ad97810b04db509505522e5bb7b9ca3b497efc731045  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  0b9f605926df4ff190ddc6c11e0f5839bffe431a3ddfd90acde1fcd2f91dada3  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d  flash_ins_bak.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  7249ad971283e164b0489110c23f4e40c64ee49b49bcc5cd0d32d9e701ec2114  files.zip  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  de17e583a4d112ce513efd4b7cb575d272dcceef229f81360ebdfa5a1e083f11  fn.exe  BIOPASS RAT binary (Nuitka)  Trojan
.Win32.BIOPASS.A  17e43d31585b4c3ac6bf724bd7263761af75a59335b285b045fce597b3825ed0
This post is also available in:      日本語 (Japanese)  On May 4, 2022, F5 released a security advisory for a remote code execution vulnerability in the iControlREST component of its BIG-IP product tracked in CVE-2022-1388.
Threat actors can exploit this vulnerability to bypass authentication and run arbitrary code on unpatched systems.
This is a critical vulnerability that needs immediate attention, as it was given a 9.8 CVSS score.
Since the release of this advisory, mass scanning activity has started to occur, seeking unpatched systems, and in-the-wild exploitation has begun.  Palo Alto Networks released a Threat Prevention signature for the F5 BIG-IP Authentication Bypass Vulnerability (92570) and within just 10 hours, the signature triggered 2,552 times due to vulnerability scanning and active exploitation attempts.
Unit 42 recommends customers upgrade to the latest release of F5 BIG-IP products.
Palo Alto Networks Next Generation Firewall Threat Prevention customers are protected with Signature 92570.
Vulnerable Systems Mitigation Actions Observed in the Wild Conclusion Additional Resources Indicators of Compromise  The F5 product vulnerable to CVE-2022-1388 is BIG-IP with the following versions:  The vulnerability exists within the iControl REST framework used by BIG-IP.
We recommend that customers update their F5 BIG-IP deployments to one of the following versions that have patches to mitigate CVE-2022-1388:
Until you can install the patched versions of BIG-IP, see the Mitigation section on the F5 security advisory for information on how to mitigate this vulnerability via a workaround to limit the vulnerable component to trusted networks.  In response to the F5 security advisory, Palo Alto Networks released the Threat Prevention signature F5 BIG-IP Authentication Bypass Vulnerability (92570) on May 9.
We observed this signature triggered 2,552 times between 4:47 and 14:00 UTC on May 10.
We were able to analyze 2,151 packets that triggered the signature and observed both vulnerability scanning activity and active exploitation attempts.
Table 1 shows the commands that would be executed in the event of successful exploitation.
These were found by analysis of the packet captures that triggered the F5 BIG-IP Authentication Bypass Vulnerability signature.
Table 1. Commands observed in CVE-2022-1388 exploitation attempts.
Palo Alto Networks customers receive protections against the exploitation of this vulnerability in the following ways:  Palo Alto Networks will update this Threat Brief with new information and recommendations as they become available.
K23605346: BIG-IP iControl REST vulnerability CVE-2022-1388 EnemyBot Attempts to Exploit CVE-2022-1388  30f7e1998d162dfad69d6d8abb763ae4033bbd4a015d170b1ad3e20d39cd4e20 da647646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d2fdbb b39d2a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c6b85d ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c 1f93a6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000baeb7 9a72aab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1847d5 53214f4d2d2dfd02b46f416cbdcb6f3a764820a50da4d59926f829b96cf82a6c  20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159  hxxps://transfer[.]sh/dlxo3I/1.sh hxxp://20.239.193[.]47/kele.sh hxxp://20.239.193[.]47/kele1 hxxp://20.187.86[.]47/dadda  Updated May 16, 2022  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
Blackgear (also known as Topgear and Comnie) is a cyberespionage campaign dating back to 2008, at least based on the Protux backdoor used by its operators.
In 2016, for instance, we found their campaigns attacking Japanese organizations with various malware tools, notably the Elirks backdoor.
Blackgear’s operators are well-organized, developing their own tools, which we observed to have been recently fine-tuned, based on their latest attacks.
A notable characteristic of Blackgear is the degree to which its attacks are taken to evade detection, abusing blogging, microblogging, and social media services to hide its command-and-control (C&C) configuration.
Compared to when C&C information is embedded within the malware, where it’s preset and can thus be easily blocked, this tactic lets Blackgear’s operators to quickly change C&C servers as needed.
It can, in turn, prolong the campaign’s foothold in the system and enable attackers to carry out further lateral movement.
Analyzing the Marade downloader (detected by Trend Micro as TSPY_MARADE.ZTBC) and the version of Protux (BKDR_PROTUX.ZTBC) employed by Blackgear’s latest campaigns, we found their encrypted configurations on blog and social media posts (see Figure 1).
This can be an indication that these malware tools were developed by the same group.
Figure 1. Marade’s encrypted configuration on a Facebook post Figure 2. Infection chain of Blackgear’s attack Attack chain
To paint a bigger picture of Blackgear’s attacks, we correlated the tools and tactics they used against their targets.
Here’s a summary of Blackgear’s latest campaign:  Use a decoy document or fake installer file, sent via spam email to lure a potential victim into clicking it.
The decoy document will extract the Marade downloader.
It drops itself in the machine’s Temp folder and increases its file size to over 50MB in order to bypass traditional sandbox solutions.
Marade will check if the infected host can connect to the internet and if it is installed with anti-virus (AV) software.
If the affected system can connect online and doesn’t have AV software, Marade will connect to a Blackgear-controlled public blog or social media post to retrieve an encrypted C&C configuration.
Otherwise, Marade will use the C&C information embedded in its code.
The encrypted strings will pose as a magnet link to keep its malicious traffic from being detected by AV software.
Marade will then decrypt the encrypted strings and retrieve the C&C server information.
The C&C server will send Protux to the victim’s host and execute it.
Protux, a known backdoor, is executed by abusing the rundll32 dynamic-link library (DLL).
It tests the host’s network, retrieves the C&C server from another blog, and uses the RSA algorithm to generate the session key and send information to the C&C server.  Blackgear’s malware tools are delivered to targets using RAR self-extracting executable (SFX) files or office Visual Basic Script (VBScript) to create a decoy document.
Below is a screenshot of the SFX files and document used by the latest campaigns: Figure 3.
Contents of malicious SFX file used by Blackgear, posing as a Flash Player installer  Figure 4. Malicious document used by Blackgear (top) and how VBScript is used to execute Marade (bottom)
Encrypted configurations of Protux (top) and Marade (bottom) in the same blog post Correlating Marade and Protux
The encrypted configurations of Marade and Protux can both be found on a single blog post.
As shown in Figure 5, the strings highlighted in red function as a search tag to identify the location of the configuration information; those highlighted in orange pertain to the encrypted configuration that Protux will retrieve.
In Blackgear’s previous campaigns, Protux’s configuration format had to be changed to another version.
For instance, Protux’s older iteration will look for the “++a++” tag, as shown in Figure 5.
The format used by Protux’s latest version is now similar to Marade’s, as shown in Figure 6.
Protux’s encrypted configuration on a public blog (note the six magnet URLs; the third is Protux’s latest configuration format)
Reverse analysis of Protux’s latest version also allowed us to determine how to decrypt the C&C information, which is done in the Python code shown below.
This can also be used by researchers, system administrators, and information security professionals when decrypting Protux’s latest version.
#-*-coding:utf-8 -*- import os, sys, datetime, operator, base64 def decrypt():     if len(sys.argv) != 2:       print "Usegae : ./decrypt_protux_magnet.py <Full magnet strings>" sys.exit(0) str = sys.argv[1] head = str.find("magnet:?xt=urn:bhih:")
tail = str.find("&xl=")     if -1 ==tail: tail = str.find("&amp;xl=")     if -1 == head or -1 == tail:       print("can't find delimiter") sys.exit()
b64_data = str[len("magnet:?xt=urn:bhih:"): tail] b64_decode = base64.b64decode(b64_data) key = ord(b64_decode[2]) data = b64_decode[4:] output_file = open("C2_info", "wb")     for single_byte in data: output_file.write(chr(ord(single_byte) ^ key)) output_file.close()
if __name__ == '__main__': decrypt (
A new remote controller tool
We were also able to source a sample of Protux’s remote controller tool.
This provides a user interface (UI) that allows attackers to send instructions to and monitor any compromised endpoint host.
This tool can also remotely control Marade in the affected system.
Figure 7.
The controller retrieving the Marade-related information (top) and collecting Protux-related information (bottom)
Based on the controller’s behavior, we can posit that both Marade and Protux were authored by the same threat actors.
Each serves a specific role once in the system.
Marade acts as the first stage of attack, sending the compromised system’s information to the C&C server and then awaiting commands from the controller.
This allows threat actors to monitor and check whether the affected system is of interest to them.
If so, the attack moves to the second stage by deploying Protux.
The tool can also control the communication between the backdoor and attacker in real time.
The following is a list of Protux’s notable components and their functions:  FileManage - Lists all of the system’s drives and folders.
ProcManage - Lists all of the processes, modules, threads, and ports in the compromised host.
ServiceManage - Lists all of the services in the compromised host.
RegManage - Lists all of the registries in the compromised host.
ScreenManage - Takes a screenshot.
ShellManage - Creates a shell.
Protux:
An old dog learning new tricks Protux is an old backdoor, with its first version developed in 2005.
It uses DLL injection to execute its routines.
Based on this behavior, we can map out a pattern, from the downloader to the decoy documents used.
The trigger format is: %system32/rundll32.exe <PROTUX file name> <export name>.
We saw two notable changes throughout Protux’s history: its export name and how it functions:
Export name Year How C&C information is retreieved TStartUp 2005 – 2012
Directly connect to the C&C server and use DNS server to retrieve the C&C IP address.
CRestart 2009 – 2014 Use web DNS query to retrieve the C&C IP address, e.g., ip138[.]com.
CReset 2013 – 2018
Find the encrypted configuration through keywords on blog services.
Our research into and correlation of Protux led us to several samples that have version numbers embedded in them.
The highlighted portions in Figure 8 show the backdoor’s version number and timestamp with the “with encrypt” strings.
We also found that these versions encrypt the communication to its C&C servers.
Protux’s latest version, 3.7, uses the open-source compiler OpenCSP to generate a session key with the RSA algorithm.
Different versions of Protux used by Blackgear Figure 9.
Protux with the OpenCSP encryption function Building a proactive incident response strategy Blackgear has been targeting various industries since its emergence a decade ago.
Its apparent staying power stems from the furtive ways with which its attacks can evade traditional security solutions.
For instance, Blackgear employs two stages of infection for each of its attacks.
The potential victim may not be able to notice the intrusions as the first stage involves only profiling and reconnaissance.
And once infection with a backdoor occurs, typical red flags may not be raised as it abuses microblogging and social media services to retrieve information needed for C&C communication.
Indeed, Blackgear’s attacks exemplify the need for organizations to develop and implement security strategies that can proactively respond to threats.
A robust threat hunting strategy, for instance, helps validate indicators of attack to ascertain if the intrusions, threats, or suspicious system activities are one-off attacks or part of a larger campaign.
This further visibility equips organizations with actionable threat intelligence, context, and insights that can be used to delve deeper into an attack — which security gaps are exploited, if the attack has multiple payloads, or if the malware has already spread within the network.
Organizations can also consider managed detection and response, which provides in-depth threat analysis and correlation — from networks to servers and endpoints — to obtain a complete picture of and further understand a targeted attack.
Managed detection and response also helps make better sense of system- and network-level activities that an organization may not have the time or resources to do.
A list of indicators of compromise (IoCs) related to Blackgear is in this appendix.
Trend Micro solutions
The Trend Micro™ Deep Discovery™ solution provides detection, in-depth analysis, and proactive response to today’s stealthy malware and targeted attacks in real time.
It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack life cycle, allowing it to detect threats delivered by Blackgear even without any engine or pattern update.
Blackgear’s campaigns also use email as an entry point, which is why it’s important to secure the email gateway.
The Trend Micro™ Hosted Email Security no-maintenance cloud solution delivers continuously updated protection to stop spam, malware, spear phishing, and advanced targeted attacks before they reach the network.
The Trend Micro™ Deep Discovery™ Email Inspector and InterScan™ Web Security solutions prevent malware from ever reaching end users.
At the endpoint level, the Trend Micro™ Smart Protection Suites deliver several capabilities that minimize the impact of attacks.
Tags  Articles, News, Reports | APT & Targeted Attacks | Research
In November 2019, we published a blog analyzing an exploit kit we named Capesand that exploited Adobe Flash and Microsoft Internet Explorer flaws.
During our analysis of the indicators of compromise (IoCs) in the deployed samples that were infecting the victim’s machines, we noticed some interesting characteristics: notably that these samples were making use of obfuscation tools that made them virtually undetectable.
After some data collection we found more than 300 samples that correlate to the mentioned indicators that were recently very active  our first detections occurred in August, with the campaign itself still ongoing (having occasional spikes in between).
We saw a rising usage of tools that provide fully-undetectable obfuscation capabilities – signifying that the authors behind the samples designed their malware variants to be as stealthy as possible.
We decided to name the potential campaign associated with these IoCs as “KurdishCoder”, based on the property name of an assembly module found in one of the samples.
We took a look at one of the samples captured from Capesand that was used to deploy the njRat malware – notably its main executable NotepadEx.
We found that were multiple layers of obfuscation using a combination of two tools: the .NET protectors ConfuserEx and Cassandra (CyaX).
Both of these tools are used in combination to provide an array of fully undetectable capabilities to the deployed njRat malware variant.
Examining the Capesand samples The simplified diagram taken from the previous blog shows the combination of ConfuserEx and Cassandra via the second layer of obfuscation protection, which involves the DLL CyaX_Sharp Assembly (both CyaX_Sharp and CyaX are part of the Cassandra protector).
The infection chain for Capesand that also shows the obfuscation mechanisms For this particular sample, CyaX_Sharp is obfuscated with a customized version of ConfuserEx.
The following image shows an assembly module property that was generated for this sample.
The generated assembly module property
The module’s property name is “KurdishCoderProducts”, with a value shown to be “ConfuserEx v1.0.0-custom”.
To understand where this value is coming from, let’s take a look at the open-source ConfuserEx tool to see how the values are created.
From there, we can establish a hypothesis as to their source.
A closer look at ConfuserEx’s functions
While ConfuserEx is able to apply multiple transformations to the target binary, we are interested in two particular functions that we can use for correlation:  Source code building.
ConfuserEx is an open-source tool with multiple versions hosted on Github.
By examining one of the community-supported versions, we can see there is a tool to build ConfuserEx from the command line.
This build command line has a function to update the final binary versions based on the last Git-tagged version.
However, if ConfuserEx is built outside Git, the version update tool will just generate the value “version-custom” as shown below.
Code taken from a ConfuserEx version created outside GIT
Since the string “ConfuserEx v1.0.0-custom” is present in the module property: [module: KurdishCoderProducts("ConfuserEx v1.0.0-custom")]”, we can surmise that the version of ConfuserEx that was used for CyaX_Sharp was indeed built outside of Git.
2. Watermarking
When ConfuserEx performs its obfuscation routine, one of the operations creates a watermark – a unique identifier within the software--that is present in the final binary.
The watermarking technique is implemented through the module attributes of the assembly.
The following source code screenshot shows how this is implemented.
Figure 4. Code showing how the watermarking is performed via the module attributes of the assembly
From the previous code section, we can see the default attribute added by ConfuserEx is “ConfusedBy”.