[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HNTZP36T0TXGC2J74X7P0Z":3,"skill-same:01M6HNTZP36T0TXGC2J74X7P0Z":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6HNTZP36T0TXGC2J74X7P0Z","reverse-engineering-dotnet-malware-with-dnspy",null,"Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#\u002FVB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Freverse-engineering-dotnet-malware-with-dnspy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"dotnet","reverse","engineering","reverse engineering","malware","with","dnSpy","reverse engineering dotnet malware with dnspy","techniques","malicious","C#","de","id","cm","analyze","analysis","obfuscation","reverse-engineering","code","cybersecurity","2026-11-10 10:12:30",false,"---\nname: reverse-engineering-dotnet-malware-with-dnspy\ndescription: Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#\u002FVB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates...\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- dotnet\n- reverse-engineering\n- dnSpy\n- decompilation\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\ncategory: reverse-engineering-dotnet-malware-with-dnspy\n---\n# Reverse-Engineering-Dotnet-Malware-With-Dnspy\n\n## Overview\nReverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#\u002FVB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis.\n\n\n\n# Reverse Engineering .NET Malware with dnSpy\n\n## When to Use\n\n- A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation\n- Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)\n- Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators\n- Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies\n- Debugging .NET malware at runtime to observe decryption routines and dynamic behavior\n\n**Do not use** for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis.\n\n## Prerequisites\n\n- dnSpy or dnSpyEx installed (https:\u002F\u002Fgithub.com\u002FdnSpyEx\u002FdnSpy - community maintained fork)\n- de4dot for automated .NET deobfuscation (`https:\u002F\u002Fgithub.com\u002Fde4dot\u002Fde4dot`)\n- ILSpy as an alternative decompiler for cross-validation\n- .NET SDK installed for recompiling modified assemblies during analysis\n- Isolated Windows VM for running dnSpy debugger on live malware\n- Detect It Easy (DIE) for identifying the .NET obfuscator used\n\n## Workflow\n\n### Step 1: Identify .NET Assembly and Obfuscator\n\nVerify the sample is a .NET binary and detect protection:\n\n```bash\n# Check if file is .NET assembly\nfile suspect.exe\n# Output should contain \"PE32 executable\" with .NET metadata\n\n# Detect obfuscator with Detect It Easy\ndiec suspect.exe\n\n# Python-based .NET detection\npython3 \u003C\u003C 'PYEOF'\nimport pefile\n\npe = pefile.PE(\"suspect.exe\")\n\n# Check for .NET COM descriptor\nif hasattr(pe, 'DIRECTORY_ENTRY_COM_DESCRIPTOR'):\n    print(\"[*] .NET assembly detected\")\n    print(f\"    Runtime version: {pe.DIRECTORY_ENTRY_COM_DESCRIPTOR}\")\nelse:\n    # Check for mscoree.dll import (alternative detection)\n    for entry in pe.DIRECTORY_ENTRY_IMPORT:\n        if entry.dll.decode().lower() == \"mscoree.dll\":\n            print(\"[*] .NET assembly detected (mscoree.dll import)\")\n            break\n    else:\n        print(\"[!] Not a .NET assembly\")\n\n# Check section names for .NET indicators\nfor section in pe.sections:\n    name = section.Name.decode().rstrip('\\x00')\n    if name in ['.text', '.rsrc', '.reloc']:\n        print(f\"    Section: {name} (typical .NET)\")\nPYEOF\n```\n\n### Step 2: Deobfuscate with de4dot\n\nRemove common .NET obfuscation before manual analysis:\n\n```bash\n# Run de4dot to identify and remove obfuscation\nde4dot suspect.exe -o suspect_cleaned.exe\n\n# Force specific deobfuscator\nde4dot suspect.exe -p cf  # ConfuserEx\nde4dot suspect.exe -p sa  # SmartAssembly\nde4dot suspect.exe -p dr  # Dotfuscator\nde4dot suspect.exe -p rv  # Reactor\nde4dot suspect.exe -p bl  # Babel.NET\n\n# Verbose output for debugging\nde4dot -v suspect.exe -o suspect_cleaned.exe\n\n# Handle multi-file assemblies\nde4dot suspect.exe suspect_helper.dll -o cleaned\u002F\n```\n\n```\nCommon .NET Obfuscators:\n━━━━━━━━━━━━━━━━━━━━━━━\nConfuserEx:      String encryption, control flow, anti-debug, anti-tamper\nSmartAssembly:   String encoding, flow obfuscation, pruning\nDotfuscator:     Renaming, string encryption, control flow\n.NET Reactor:    Native code generation, necrobit, anti-debug\nBabel.NET:       String encryption, resource encryption, code virtualization\nCrypto Obfuscator: String encryption, anti-debug, watermarking\nCustom:          Malware-specific obfuscation (manual de4dot configuration needed)\n```\n\n### Step 3: Open in dnSpy and Analyze Code\n\nLoad the deobfuscated assembly in dnSpy for source-level analysis:\n\n```\ndnSpy Analysis Workflow:\n━━━━━━━━━━━━━━━━━━━━━━━\n1. File -> Open -> Select cleaned assembly\n2. Navigate to the entry point:\n   - Assembly Explorer -> \u003Cnamespace> -> Program class -> Main method\n   - Or: Right-click assembly -> Go to Entry Point\n\n3. Key areas to examine:\n   - Entry point (Main) for initialization and execution flow\n   - Form classes for UI-based malware (RATs, stealers)\n   - Network\u002FHTTP classes for C2 communication\n   - Crypto\u002Fencryption classes for data protection\n   - Resource access for embedded payloads\n   - Timer\u002FThread classes for persistence and scheduling\n\n4. Navigation shortcuts:\n   Ctrl+G       - Go to token\u002Faddress\n   Ctrl+Shift+K - Search assemblies\n   F12          - Go to definition\n   Ctrl+R       - Analyze (find usages)\n   F5           - Start debugging\n   F9           - Toggle breakpoint\n```\n\n### Step 4: Extract Configuration and C2 Data\n\nLocate hardcoded configuration in the decompiled source:\n\n```csharp\n\u002F\u002F Common .NET malware configuration patterns:\n\n\u002F\u002F Pattern 1: Static class with hardcoded values\npublic static class Config {\n    public static string Host = \"185.220.101.42\";\n    public static int Port = 4782;\n    public static string Key = \"GhOsT_RaT_2025\";\n    public static string Mutex = \"AsyncMutex_6SI8OkPnk\";\n    public static bool Install = true;\n    public static string InstallFolder = \"%AppData%\";\n}\n\n\u002F\u002F Pattern 2: Encrypted strings decrypted at runtime\npublic static string Decrypt(string input) {\n    byte[] data = Convert.FromBase64String(input);\n    byte[] key = Encoding.UTF8.GetBytes(\"SecretKey123\");\n    for (int i = 0; i \u003C data.Length; i++) {\n        data[i] ^= key[i % key.Length];\n    }\n    return Encoding.UTF8.GetString(data);\n}\n\n\u002F\u002F Pattern 3: Resource-embedded configuration\nbyte[] configData = Properties.Resources.config;\nstring config = AES.Decrypt(configData, derivedKey);\n```\n\n```python\n# Python script to extract .NET resource strings\nimport subprocess\nimport re\nimport base64\n\n# Use monodis (Mono) or ildasm (.NET SDK) to dump IL\nresult = subprocess.run(\n    [\"monodis\", \"--output=il_dump.il\", \"suspect_cleaned.exe\"],\n    capture_output=True, text=True\n)\n\n# Search for string literals in IL dump\nwith open(\"il_dump.il\", errors=\"ignore\") as f:\n    il_code = f.read()\n\n# Find ldstr (load string) instructions\nstrings = re.findall(r'ldstr\\s+\"([^\"]+)\"', il_code)\nfor s in strings:\n    # Check for Base64 encoded strings\n    try:\n        decoded = base64.b64decode(s).decode('utf-8', errors='ignore')\n        if len(decoded) > 3 and decoded.isprintable():\n            print(f\"  Base64: {s[:40]}... -> {decoded[:100]}\")\n    except:\n        pass\n    # Check for URLs\u002FIPs\n    if re.match(r'https?:\u002F\u002F', s) or re.match(r'\\d+\\.\\d+\\.\\d+\\.\\d+', s):\n        print(f\"  Network: {s}\")\n```\n\n### Step 5: Debug with dnSpy\n\nSet breakpoints and debug the malware to observe runtime behavior:\n\n```\ndnSpy Debugging Workflow:\n━━━━━━━━━━━━━━━━━━━━━━━\n1. Set breakpoints on key methods:\n   - String decryption functions (to capture decrypted values)\n   - Network connection methods (to capture C2 URLs)\n   - File write operations (to see what is dropped)\n   - Registry modification methods (to see persistence)\n\n2. Debug -> Start Debugging (F5)\n   - Select the assembly to debug\n   - Set command-line arguments if needed\n   - Configure exception handling (break on all CLR exceptions)\n\n3. At each breakpoint:\n   - Inspect local variables (Locals window)\n   - Evaluate expressions (Immediate window)\n   - View call stack to understand execution context\n   - Step over (F10) \u002F Step into (F11) \u002F Step out (Shift+F11)\n\n4. Capture decrypted strings:\n   - Set breakpoint after decryption function returns\n   - Read the return value from the Locals window\n   - Document all decrypted configuration values\n```\n\n### Step 6: Document Findings\n\nCompile analysis results into a structured report:\n\n```\nAnalysis documentation should include:\n- .NET assembly metadata (CLR version, target framework, compilation info)\n- Obfuscator identified and deobfuscation method used\n- Complete C2 configuration (hosts, ports, encryption keys, mutex names)\n- Malware capabilities (keylogging, screen capture, file theft, etc.)\n- Persistence mechanisms (registry, scheduled tasks, startup folder)\n- Anti-analysis techniques (VM detection, debugger detection, sandbox evasion)\n- Extracted IOCs (C2 IPs\u002Fdomains, file hashes, mutex names, registry keys)\n- YARA rule based on unique code patterns or strings\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **CIL\u002FMSIL** | Common Intermediate Language; the bytecode format .NET assemblies compile to, which can be decompiled back to high-level C#\u002FVB.NET |\n| **Metadata Token** | Unique identifier for .NET types, methods, and fields within the assembly metadata tables; used for navigation in dnSpy |\n| **de4dot** | Open-source .NET deobfuscator that identifies and removes protection from many commercial and malware-specific obfuscators |\n| **ConfuserEx** | Popular open-source .NET obfuscator frequently used by malware authors for string encryption and control flow obfuscation |\n| **String Encryption** | Obfuscation technique replacing string literals with encrypted data and runtime decryption calls to hide IOCs from static analysis |\n| **Resource Embedding** | Storing configuration, payloads, or additional assemblies in .NET embedded resources, often encrypted with a key derived from assembly metadata |\n| **Assembly.Load** | .NET method loading assemblies from byte arrays in memory, enabling fileless execution of embedded payloads |\n\n## Tools & Systems\n\n- **dnSpy\u002FdnSpyEx**: Open-source .NET assembly editor, decompiler, and debugger supporting C# and VB.NET decompilation\n- **de4dot**: Automated .NET deobfuscator supporting ConfuserEx, SmartAssembly, Dotfuscator, Reactor, and many other protectors\n- **ILSpy**: Open-source .NET decompiler providing C#, VB.NET, and IL views of assembly code\n- **dotPeek**: JetBrains' free .NET decompiler with symbol server and cross-reference navigation\n- **Detect It Easy (DIE)**: Multi-format file analyzer identifying .NET framework version, obfuscator, and compiler information\n\n## Common Scenarios\n\n### Scenario: Analyzing an AgentTesla Information Stealer\n\n**Context**: A phishing email delivers a .NET executable identified as AgentTesla. The sample needs analysis to determine what credentials it steals, how it exfiltrates data, and its C2 configuration.\n\n**Approach**:\n1. Run Detect It Easy to identify the obfuscator (commonly ConfuserEx or custom)\n2. Deobfuscate with de4dot to restore readable class\u002Fmethod names and decrypt strings\n3. Open in dnSpy and navigate to the entry point to understand initialization\n4. Locate the credential harvesting modules (browser, email, FTP, VPN password theft classes)\n5. Find the exfiltration method (SMTP email, FTP upload, HTTP POST, Telegram bot API)\n6. Extract C2 configuration (SMTP server, credentials, recipient email, or HTTP URL)\n7. Set debugger breakpoints on the decryption function to capture all decrypted strings at once\n\n**Pitfalls**:\n- Analyzing without de4dot first (ConfuserEx makes manual analysis extremely difficult)\n- Not checking for multi-stage loading (initial .NET executable may load additional assemblies from resources)\n- Missing configuration stored in .NET resources rather than hardcoded strings\n- Running the debugger without network isolation (AgentTesla will attempt to exfiltrate immediately)\n\n## Output Format\n\n```\n.NET MALWARE ANALYSIS REPORT\n================================\nSample:           invoice_scanner.exe\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nType:             .NET Assembly (C#)\nFramework:        .NET Framework 4.8\nObfuscator:       ConfuserEx v1.6\nDeobfuscated:     Yes (de4dot -p cf)\n\nCLASSIFICATION\nFamily:           AgentTesla v3\nType:             Information Stealer \u002F Keylogger\nCompile Date:     2025-09-10\n\nC2 CONFIGURATION\nExfil Method:     SMTP (Email)\nSMTP Server:      smtp.yandex[.]com:587\nSMTP User:        exfil.account@yandex[.]com\nSMTP Pass:        Str0ngP@ssw0rd2025\nRecipient:        operator@protonmail[.]com\nInterval:         30 minutes\nEncryption:       AES-256 with key \"AgentTesla_2025_key\"\n\nCAPABILITIES\n[*] Browser credential theft (Chrome, Firefox, Edge, Opera)\n[*] Email client passwords (Outlook, Thunderbird)\n[*] FTP client credentials (FileZilla, WinSCP)\n[*] VPN credentials (NordVPN, OpenVPN)\n[*] Keylogging (SetWindowsHookEx)\n[*] Screenshot capture (every 30 seconds)\n[*] Clipboard monitoring\n\nPERSISTENCE\nMethod:           Registry Run key + Scheduled Task\nRegistry:         HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate\nTask:             \\Microsoft\\Windows\\WindowsUpdate\\Updater\n\nEXTRACTED IOCs\nSMTP Server:      smtp.yandex[.]com\nExfil Email:      exfil.account@yandex[.]com\nRecipient:        operator@protonmail[.]com\nMutex:            AgentTesla_2025_Q3_MUTEX\nInstall Path:     %AppData%\\Microsoft\\Windows\\svchost.exe\n```\n","# Reverse-Engineering-Dotnet-Malware-With-Dnspy\n\n## Overview\nReverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#\u002FVB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis.\n\n\n\n# Reverse Engineering .NET Malware with dnSpy\n\n## When to Use\n\n- A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation\n- Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)\n- Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators\n- Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies\n- Debugging .NET malware at runtime to observe decryption routines and dynamic behavior\n\n**Do not use** for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis.\n\n## Prerequisites\n\n- dnSpy or dnSpyEx installed (https:\u002F\u002Fgithub.com\u002FdnSpyEx\u002FdnSpy - community maintained fork)\n- de4dot for automated .NET deobfuscation (`https:\u002F\u002Fgithub.com\u002Fde4dot\u002Fde4dot`)\n- ILSpy as an alternative decompiler for cross-validation\n- .NET SDK installed for recompiling modified assemblies during analysis\n- Isolated Windows VM for running dnSpy debugger on live malware\n- Detect It Easy (DIE) for identifying the .NET obfuscator used\n\n## Workflow\n\n### Step 1: Identify .NET Assembly and Obfuscator\n\nVerify the sample is a .NET binary and detect protection:\n\n```bash\n# Check if file is .NET assembly\nfile suspect.exe\n# Output should contain \"PE32 executable\" with .NET metadata\n\n# Detect obfuscator with Detect It Easy\ndiec suspect.exe\n\n# Python-based .NET detection\npython3 \u003C\u003C 'PYEOF'\nimport pefile\n\npe = pefile.PE(\"suspect.exe\")\n\n# Check for .NET COM descriptor\nif hasattr(pe, 'DIRECTORY_ENTRY_COM_DESCRIPTOR'):\n    print(\"[*] .NET assembly detected\")\n    print(f\"    Runtime version: {pe.DIRECTORY_ENTRY_COM_DESCRIPTOR}\")\nelse:\n    # Check for mscoree.dll import (alternative detection)\n    for entry in pe.DIRECTORY_ENTRY_IMPORT:\n        if entry.dll.decode().lower() == \"mscoree.dll\":\n            print(\"[*] .NET assembly detected (mscoree.dll import)\")\n            break\n    else:\n        print(\"[!] Not a .NET assembly\")\n\n# Check section names for .NET indicators\nfor section in pe.sections:\n    name = section.Name.decode().rstrip('\\x00')\n    if name in ['.text', '.rsrc', '.reloc']:\n        print(f\"    Section: {name} (typical .NET)\")\nPYEOF\n```\n\n### Step 2: Deobfuscate with de4dot\n\nRemove common .NET obfuscation before manual analysis:\n\n```bash\n# Run de4dot to identify and remove obfuscation\nde4dot suspect.exe -o suspect_cleaned.exe\n\n# Force specific deobfuscator\nde4dot suspect.exe -p cf  # ConfuserEx\nde4dot suspect.exe -p sa  # SmartAssembly\nde4dot suspect.exe -p dr  # Dotfuscator\nde4dot suspect.exe -p rv  # Reactor\nde4dot suspect.exe -p bl  # Babel.NET\n\n# Verbose output for debugging\nde4dot -v suspect.exe -o suspect_cleaned.exe\n\n# Handle multi-file assemblies\nde4dot suspect.exe suspect_helper.dll -o cleaned\u002F\n```\n\n```\nCommon .NET Obfuscators:\n━━━━━━━━━━━━━━━━━━━━━━━\nConfuserEx:      String encryption, control flow, anti-debug, anti-tamper\nSmartAssembly:   String encoding, flow obfuscation, pruning\nDotfuscator:     Renaming, string encryption, control flow\n.NET Reactor:    Native code generation, necrobit, anti-debug\nBabel.NET:       String encryption, resource encryption, code virtualization\nCrypto Obfuscator: String encryption, anti-debug, watermarking\nCustom:          Malware-specific obfuscation (manual de4dot configuration needed)\n```\n\n### Step 3: Open in dnSpy and Analyze Code\n\nLoad the deobfuscated assembly in dnSpy for source-level analysis:\n\n```\ndnSpy Analysis Workflow:\n━━━━━━━━━━━━━━━━━━━━━━━\n1. File -> Open -> Select cleaned assembly\n2. Navigate to the entry point:\n   - Assembly Explorer -> \u003Cnamespace> -> Program class -> Main method\n   - Or: Right-click assembly -> Go to Entry Point\n\n3. Key areas to examine:\n   - Entry point (Main) for initialization and execution flow\n   - Form classes for UI-based malware (RATs, stealers)\n   - Network\u002FHTTP classes for C2 communication\n   - Crypto\u002Fencryption classes for data protection\n   - Resource access for embedded payloads\n   - Timer\u002FThread classes for persistence and scheduling\n\n4. Navigation shortcuts:\n   Ctrl+G       - Go to token\u002Faddress\n   Ctrl+Shift+K - Search assemblies\n   F12          - Go to definition\n   Ctrl+R       - Analyze (find usages)\n   F5           - Start debugging\n   F9           - Toggle breakpoint\n```\n\n### Step 4: Extract Configuration and C2 Data\n\nLocate hardcoded configuration in the decompiled source:\n\n```csharp\n\u002F\u002F Common .NET malware configuration patterns:\n\n\u002F\u002F Pattern 1: Static class with hardcoded values\npublic static class Config {\n    public static string Host = \"185.220.101.42\";\n    public static int Port = 4782;\n    public static string Key = \"GhOsT_RaT_2025\";\n    public static string Mutex = \"AsyncMutex_6SI8OkPnk\";\n    public static bool Install = true;\n    public static string InstallFolder = \"%AppData%\";\n}\n\n\u002F\u002F Pattern 2: Encrypted strings decrypted at runtime\npublic static string Decrypt(string input) {\n    byte[] data = Convert.FromBase64String(input);\n    byte[] key = Encoding.UTF8.GetBytes(\"SecretKey123\");\n    for (int i = 0; i \u003C data.Length; i++) {\n        data[i] ^= key[i % key.Length];\n    }\n    return Encoding.UTF8.GetString(data);\n}\n\n\u002F\u002F Pattern 3: Resource-embedded configuration\nbyte[] configData = Properties.Resources.config;\nstring config = AES.Decrypt(configData, derivedKey);\n```\n\n```python\n# Python script to extract .NET resource strings\nimport subprocess\nimport re\nimport base64\n\n# Use monodis (Mono) or ildasm (.NET SDK) to dump IL\nresult = subprocess.run(\n    [\"monodis\", \"--output=il_dump.il\", \"suspect_cleaned.exe\"],\n    capture_output=True, text=True\n)\n\n# Search for string literals in IL dump\nwith open(\"il_dump.il\", errors=\"ignore\") as f:\n    il_code = f.read()\n\n# Find ldstr (load string) instructions\nstrings = re.findall(r'ldstr\\s+\"([^\"]+)\"', il_code)\nfor s in strings:\n    # Check for Base64 encoded strings\n    try:\n        decoded = base64.b64decode(s).decode('utf-8', errors='ignore')\n        if len(decoded) > 3 and decoded.isprintable():\n            print(f\"  Base64: {s[:40]}... -> {decoded[:100]}\")\n    except:\n        pass\n    # Check for URLs\u002FIPs\n    if re.match(r'https?:\u002F\u002F', s) or re.match(r'\\d+\\.\\d+\\.\\d+\\.\\d+', s):\n        print(f\"  Network: {s}\")\n```\n\n### Step 5: Debug with dnSpy\n\nSet breakpoints and debug the malware to observe runtime behavior:\n\n```\ndnSpy Debugging Workflow:\n━━━━━━━━━━━━━━━━━━━━━━━\n1. Set breakpoints on key methods:\n   - String decryption functions (to capture decrypted values)\n   - Network connection methods (to capture C2 URLs)\n   - File write operations (to see what is dropped)\n   - Registry modification methods (to see persistence)\n\n2. Debug -> Start Debugging (F5)\n   - Select the assembly to debug\n   - Set command-line arguments if needed\n   - Configure exception handling (break on all CLR exceptions)\n\n3. At each breakpoint:\n   - Inspect local variables (Locals window)\n   - Evaluate expressions (Immediate window)\n   - View call stack to understand execution context\n   - Step over (F10) \u002F Step into (F11) \u002F Step out (Shift+F11)\n\n4. Capture decrypted strings:\n   - Set breakpoint after decryption function returns\n   - Read the return value from the Locals window\n   - Document all decrypted configuration values\n```\n\n### Step 6: Document Findings\n\nCompile analysis results into a structured report:\n\n```\nAnalysis documentation should include:\n- .NET assembly metadata (CLR version, target framework, compilation info)\n- Obfuscator identified and deobfuscation method used\n- Complete C2 configuration (hosts, ports, encryption keys, mutex names)\n- Malware capabilities (keylogging, screen capture, file theft, etc.)\n- Persistence mechanisms (registry, scheduled tasks, startup folder)\n- Anti-analysis techniques (VM detection, debugger detection, sandbox evasion)\n- Extracted IOCs (C2 IPs\u002Fdomains, file hashes, mutex names, registry keys)\n- YARA rule based on unique code patterns or strings\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **CIL\u002FMSIL** | Common Intermediate Language; the bytecode format .NET assemblies compile to, which can be decompiled back to high-level C#\u002FVB.NET |\n| **Metadata Token** | Unique identifier for .NET types, methods, and fields within the assembly metadata tables; used for navigation in dnSpy |\n| **de4dot** | Open-source .NET deobfuscator that identifies and removes protection from many commercial and malware-specific obfuscators |\n| **ConfuserEx** | Popular open-source .NET obfuscator frequently used by malware authors for string encryption and control flow obfuscation |\n| **String Encryption** | Obfuscation technique replacing string literals with encrypted data and runtime decryption calls to hide IOCs from static analysis |\n| **Resource Embedding** | Storing configuration, payloads, or additional assemblies in .NET embedded resources, often encrypted with a key derived from assembly metadata |\n| **Assembly.Load** | .NET method loading assemblies from byte arrays in memory, enabling fileless execution of embedded payloads |\n\n## Tools & Systems\n\n- **dnSpy\u002FdnSpyEx**: Open-source .NET assembly editor, decompiler, and debugger supporting C# and VB.NET decompilation\n- **de4dot**: Automated .NET deobfuscator supporting ConfuserEx, SmartAssembly, Dotfuscator, Reactor, and many other protectors\n- **ILSpy**: Open-source .NET decompiler providing C#, VB.NET, and IL views of assembly code\n- **dotPeek**: JetBrains' free .NET decompiler with symbol server and cross-reference navigation\n- **Detect It Easy (DIE)**: Multi-format file analyzer identifying .NET framework version, obfuscator, and compiler information\n\n## Common Scenarios\n\n### Scenario: Analyzing an AgentTesla Information Stealer\n\n**Context**: A phishing email delivers a .NET executable identified as AgentTesla. The sample needs analysis to determine what credentials it steals, how it exfiltrates data, and its C2 configuration.\n\n**Approach**:\n1. Run Detect It Easy to identify the obfuscator (commonly ConfuserEx or custom)\n2. Deobfuscate with de4dot to restore readable class\u002Fmethod names and decrypt strings\n3. Open in dnSpy and navigate to the entry point to understand initialization\n4. Locate the credential harvesting modules (browser, email, FTP, VPN password theft classes)\n5. Find the exfiltration method (SMTP email, FTP upload, HTTP POST, Telegram bot API)\n6. Extract C2 configuration (SMTP server, credentials, recipient email, or HTTP URL)\n7. Set debugger breakpoints on the decryption function to capture all decrypted strings at once\n\n**Pitfalls**:\n- Analyzing without de4dot first (ConfuserEx makes manual analysis extremely difficult)\n- Not checking for multi-stage loading (initial .NET executable may load additional assemblies from resources)\n- Missing configuration stored in .NET resources rather than hardcoded strings\n- Running the debugger without network isolation (AgentTesla will attempt to exfiltrate immediately)\n\n## Output Format\n\n```\n.NET MALWARE ANALYSIS REPORT\n================================\nSample:           invoice_scanner.exe\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nType:             .NET Assembly (C#)\nFramework:        .NET Framework 4.8\nObfuscator:       ConfuserEx v1.6\nDeobfuscated:     Yes (de4dot -p cf)\n\nCLASSIFICATION\nFamily:           AgentTesla v3\nType:             Information Stealer \u002F Keylogger\nCompile Date:     2025-09-10\n\nC2 CONFIGURATION\nExfil Method:     SMTP (Email)\nSMTP Server:      smtp.yandex[.]com:587\nSMTP User:        exfil.account@yandex[.]com\nSMTP Pass:        Str0ngP@ssw0rd2025\nRecipient:        operator@protonmail[.]com\nInterval:         30 minutes\nEncryption:       AES-256 with key \"AgentTesla_2025_key\"\n\nCAPABILITIES\n[*] Browser credential theft (Chrome, Firefox, Edge, Opera)\n[*] Email client passwords (Outlook, Thunderbird)\n[*] FTP client credentials (FileZilla, WinSCP)\n[*] VPN credentials (NordVPN, OpenVPN)\n[*] Keylogging (SetWindowsHookEx)\n[*] Screenshot capture (every 30 seconds)\n[*] Clipboard monitoring\n\nPERSISTENCE\nMethod:           Registry Run key + Scheduled Task\nRegistry:         HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate\nTask:             \\Microsoft\\Windows\\WindowsUpdate\\Updater\n\nEXTRACTED IOCs\nSMTP Server:      smtp.yandex[.]com\nExfil Email:      exfil.account@yandex[.]com\nRecipient:        operator@protonmail[.]com\nMutex:            AgentTesla_2025_Q3_MUTEX\nInstall Path:     %AppData%\\Microsoft\\Windows\\svchost.exe\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"category":5,"nist_csf":53,"subdomain":58,"description":7,"mitre_attack":59},[28,24,41,30,50],"decompilation","mahipal","1.0.0",[54,55,56,57],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","malware-analysis",[60,61,62,63],"T1027","T1055","T1140","T1497","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Freverse-engineering-dotnet-malware-with-dnspy",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill reverse-engineering-dotnet-malware-with-dnspy",{"tool":78,"command":79},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill reverse-engineering-dotnet-malware-with-dnspy",{"tool":81,"command":82},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill reverse-engineering-dotnet-malware-with-dnspy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Freverse-engineering-dotnet-malware-with-dnspy\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Freverse-engineering-dotnet-malware-with-dnspy\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2531,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Freverse-engineering-dotnet-malware-with-dnspy\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",8248,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Freverse-engineering-dotnet-malware-with-dnspy\u002Fscripts\u002Fagent.py",[104,135,160,182,198,217],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":115,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[116,117,118,119,120,121,43,122,123,124,125,126,127,128,129,130,131,132,133,134],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[142,143,144,145,29,43,146,147,148,149,150,151,152,153,154,155,156,157,158,159],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[167,168,132,43,169,170,171,128,129,39,172,173,174,175,176,177,178,179,180,181],"security","triaging security incident","actions","soc","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[167,189,190,168,132,29,43,191,170,125,192,193,128,129,194,172,155,195,196,197],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[167,205,206,207,208,209,43,210,211,212,170,213,128,214,215,216,175,37,132,35],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":223,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[224,225,226,227,43,228,229,230,231,232,233,214,234,235,37,236,35,237,238,239],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]