Malware Analysis - Agniane Stealer, Native Stub to .NET Unpacking

We trace API calls of a packed native file using hasherezade's tiny_tracer and discover that it unpacks a .NET payload. Using x64dbg we unpack the .NET assembly and find it unreadable, among others due to dr4k0nia's XOR string obfuscation.

Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Sample: https://bazaar.abuse.ch/sample/63af1bc6256086131314311b5908c85399b95dda6c4c6e84c8d77bd1b4d1fc43

tiny_tracer: https://github.com/hasherezade/tiny_tracer
PortexAnalyzerGUI: https://github.com/struppigel/PortexAnalyzerGUI/releases/tag/0.12.12
x64dbg: https://help.x64dbg.com/en/latest/
de4dot: https://github.com/de4dot/de4dot
dnSpy: https://github.com/dnSpyEx/dnSpy

analysis api assembly discover file find malware malware analysis obfuscation payload stealer trace unpack unpacking x64dbg xor