Dotnet string decryptor

Welcome back! This is a short blog post about reverse engineering dotnet malware.

When working with dotnet malware samples I always come around samples with obfuscated strings which makes analysis harder.

My go to way to handle this situation was to identify the string decryption routine (through static/dynamic analysis) then use de4dot to decrypt the strings.

But sometimes you don’t want to go through every sample and find the decryption routine or you need to automate this process for a …

analysis back blog blog post decrypt decryption decryptor dotnet dynamic dynamic analysis engineering go to identify malware obfuscated reverse reverse engineering strings working