I am trying to analyze a .NET file that I suspect is malicious. The file is protected by XerinObfuscator and also has Anti-dnSpy and Anti-debug protection. I tried to use de4dot to deobfuscate it, but encountered an error. Here are the details: (Sorry for my english)
File info:
File name: WIN.exe
File size: 10.24 MB
Base address: 0000000000400000
Entry point: 0000000000400000
MIME type: application/x-dosexec
Protection and obfuscation:
Obfuscator: XerinObfuscator
Protection:
Anti-debug
Anti-dnSpy
Obfuscation (Modified EP + CLR constructor + Strange EP position + Strange sections)
Packer: Compressed or packed data (High entropy + Section 0 compressed)
Tools used:
de4dot: An error occurs when attempting to deobfuscate:
Copy
Unhandled exception: System.ApplicationException: Invalid new target, it's null
in de4dot.blocks.Block.ReplaceLastInstrsWithBranch(Int32 numInstrs, Block target)
The file is recognized as protected by an unknown obfuscator, but the deobfuscation terminates with an error.
Detect It Easy: Confirms the presence of obfuscation and protection mechanisms.
Additional details:
Linker: Microsoft Linker
Language: C#
Libraries: .NET Framework 4.8, Costura.Fody, Guna UI
Tool: Visual Studio
Protectors: ByteGuard, XerinObfuscator
What I tried:
- Using de4dot (de4dot-cex).
- Using dnSpy (but the file has Anti-dnSpy protection, and I got many errors).
- Using ExtremeDumper, the file closes immediately even if I open it without other programs running.
- Analyzed via VirusTotal - see https://www.virustotal.com/gui/file/b7d7b3ffcff7b9574369aa9af6e9f155861f9bcf3c55434c8b89a6ffef6f8d6f
- Analyzing via Install and Follow in Uninstall Tool (Found only that the file saves the screenshot to a randomly named folder in the images folder and has a random name and .jpeg format).
Question:
- Is there any way to bypass XerinObfuscator and Anti-dnSpy protection?
- What tools or methods can be used to deobfuscate such a file?
- How can I analyze the behavior of a program if it is protected by Anti-debug?
Additional information:
- The file is probably malicious (stiller) as it saves screenshots to a hidden folder.
- Screenshot from DIE: https://ibb.co/cH70Kb7
- On the Xerin's Github, I found a Telegram channel where there was a link to some stiller, and the author (Repo's author) is SmokeLoader.
- Screenshot with errors and files that dnSpy was able to get (I apologize that in Russian): https://ibb.co/HLr3ZQsH, https://ibb.co/W4kZS957.
- File download (30 days): https://easyupload.io/ht0xzt
- File found in Telegram channel - https://t.me/+KxxtvBVmA25mYzhi (@SATURN_SOFTWARE), message link - https://t.me/c/2053026588/8893
- .NET Deobfuscators list - https://github.com/NotPrab/.NET-Deobfuscator
