Analyse, hunt and classify malware using .NET metadata

Introduction

Earlier this week, I ran into a sample that turned out to be PureCrypter, a loader and obfuscator for all different kinds of malware such as Agent Tesla and RedLine. 

Upon further investigation, I developed Yara rules for the various stages, which can be found here (excluding the final payload):

• PureZip
• PureCrypter
• 2nd stage downloader (PureLogStealer related)

With that out of the way, all of this reminded me of the fact that we can also write Yara rules …

assembly async building client console default dotnet import log malware analysis name names project quasar rat update