Malware Analysis - ConfuserEx 2 Deobfuscation with Python and dnlib, BBTok Loader
We deobfuscate BBTok loader, a .NET sample that is protected with ConfuserEx 2.
We use de4dot-cex for control flow deobfuscation, then write Python scripts with dnlib for ConfuserEx 2 String deobfuscation.
Sample: https://bazaar.abuse.ch/sample/24fac4...
GDATA Techblog article: https://www.gdatasoftware.com/blog/20...
Malware analysis courses: https://malwareanalysis-for-hedgehogs...
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: / struppigel
00:00 Intro
01:15 Triage
07:02 Control Flow Deobfuscation de4dot-cex
08:54 Removing anti-reversing checks
12:46 Resolving one string dynamically
19:15 Python script to extract decryption arguments
28:45 Dynamically resolving all strings
34:44 Converting keys and strings to Python dict
40:53 Python deobfuscation script
#confuserex #python #reverseengineering #malware #malwareanalysis