Analyzing .NET Downloader, Suspicious PowerShell activity and a Curious Open Directory
I recently came across an interesting .NET downloader that displayed odd Powershell activity along with an open directory full of obfuscated files. In this video, we’ll investigate this highly obfuscated .net downloader to discuss techniques to unravel it’s capabilities. We’ll…
I recently came across an interesting .NET downloader that displayed odd Powershell activity along with an open directory full of obfuscated files. In this video, we’ll investigate this highly obfuscated .net downloader to discuss techniques to unravel it’s capabilities. We’ll then look at how it redirects STDIN for the Powershell proceess to a stream buffer to avoid leaving evidence in the logs. And finally, we’ll unravel the Powershell script used to download and decrypt the open directory full of malicious files.
Tools: dnSpyEx, CyberChef
Resources: hXXps://github[.]com/jstrosch/malware-samples/tree/master/binaries/cryptbot/2023/February
