domains / families / security / reverse-engineering-dotnet-malware-with-dnspy

reverse-engineering-dotnet-malware-with-dnspy

separate

'Reverse engineers .NET malware samples using the dnSpy decompiler and

When to use

• A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation
• Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)
• Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators
• Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies
• Debugging .NET malware at runtime to observe decryption routines and dynamic behavior

When not to use

• native (unmanaged) PE binaries

Skill page

Source