Malware Analysis - .NETReactor deobfuscation and configuration extraction of AgentTesla

This is the sample that we unpacked in the previous episode. It is obfuscated with .NETReactor. We use Shed to obtain decrypted strings and get an idea of what it is doing. Removing the obfuscation with NetReactorSlayer does not work out of the box. Is there a way we make it work to obtain the configuration values?

Tools: DnSpy, Shed, PortexAnalyzer, SystemInformer, NetReactorSlayer

Malware course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=CE8D957072A4B79B5EB2
Sample: https://malshare.com/sample.php?action=detail&hash=45dc4518fbf43bf4611446159f72cdbc37641707bb924bd2a52644a3af5bab76

Twitter: https://twitter.com/struppigel

00:00 Intro
00:25 Strings and DnSpy
03:37 Shed - decrypted …

agenttesla analysis box configuration deobfuscation doing malware malware analysis obfuscated obfuscation sample shed strings work