Reverse Engineering Dotnet Malware With Dnspy

Reverse Engineering Dotnet Malware With Dnspy

Overview

Cybersecurity skill for reverse engineering dotnet malware with dnspy. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "reverse engineering dotnet malware with dnspy"

• "reverseing engineering dotnet malware with dnspy"

• "Reverse engineers "

• A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation

• Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)

• Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators

• Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies

• Debugging .NET malware at runtime to observe decryption routines and dynamic behavior

Do not use for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• dnSpy or dnSpyEx installed (https://github.com/dnSpyEx/dnSpy - community maintained fork)
• de4dot for automated .NET deobfuscation (https://github.com/de4dot/de4dot)
• ILSpy as an alternative decompiler for cross-validation
• .NET SDK installed for recompiling modified assemblies during analysis
• Isolated Windows VM for running dnSpy debugger on live malware
• Detect It Easy (DIE) for identifying the .NET obfuscator used

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Define Objectives — Clarify the goals and scope for engineering dotnet malware.
2. Gather Resources — Collect tools, data, and access needed for engineering dotnet malware.
3. Execute Process — Carry out engineering dotnet malware operations methodically.
4. Verify Quality — Check results against acceptance criteria.
5. Document Outcomes — Record findings, decisions, and next steps.

Tools

• dnspy — Primary tool for this skill
• Analysis Platform — Data processing and visualization
• Collaboration Tools — Team coordination and knowledge sharing

Process

1. Reconnaissance — Gather target information, identify attack surface, enumerate services
2. Analysis/Exploitation — Execute the technique, analyze results, document findings
3. Reporting — Document IOCs, write findings, provide remediation recommendations

Verification

• All engineering dotnet malware procedures executed completely and documented
• Findings validated against multiple data sources
• False positives identified and filtered
• Results documented with evidence and timestamps
• Recommendations provided with risk-based prioritization

Anti-Rationalization Table