reverse-engineering-dotnet-malware-with-dnspy

Featured

Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Reverse Engineering .NET Malware with dnSpy ## When to Use - A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation - Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT) - Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators - Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies - Debugging .NET malware at runtime to observe decryption routines and dynamic behavior **Do not use** for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis. ## Prerequisites - dnSpy or dnSpyEx installed (https://github.com/dnSpyEx/dnSpy - community maintained fork) - de4dot for automated .NET deobfuscation (`https://github.com/de4dot/de4dot`) - ILSpy as an alternative decompiler for cross-validation - .NET SDK installed for recompiling modified assemblies during analysis - Isolated Windows VM for running dnSpy debugger on live malware - Detect It Easy (DIE) for identifying the .NET obfuscator used ## Workflow ### Step 1: Identify .NET Assembly and Obfuscator Verify the sample is a .NET binary and detect protection: ```bash # Check if file is .NET assembly file suspect.exe # Output should contain "PE32 executable" with .NET metadata # Detect obfuscator with Detect It Easy diec suspect.exe # Python-based .NET detection python3 << 'PYEOF' import pefile pe = pefile.PE("suspect.exe") # Check for .NET COM descriptor if...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

reverse-engineering-malware-with-ghidra

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.

12,642 Updated today
mukul975
AI & Automation Featured

deobfuscating-powershell-obfuscated-malware

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

12,642 Updated today
mukul975
AI & Automation Featured

reverse-engineering-rust-malware

Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated strings, crate dependency extraction, and Rust-specific control flow analysis.

12,642 Updated today
mukul975
Data & Documents Solid

ctf-malware

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

2,227 Updated 4 weeks ago
ljagiello
Data & Documents Listed

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

335 Updated today
aiskillstore