{"id":1156,"date":"2015-09-25T09:11:14","date_gmt":"2015-09-25T09:11:14","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=1156"},"modified":"2015-09-29T19:12:10","modified_gmt":"2015-09-29T19:12:10","slug":"3-stage-dot-net-trojan","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2015\/09\/3-stage-dot-net-trojan\/","title":{"rendered":"3 stage dot net Trojan"},"content":{"rendered":"

Howdy fellow readers. My time is split between video games, code, and work. I have a number of interesting samples I’ve seen that I’ve decided to share with you all.<\/p>\n

This is a 3+ stage malware. Each stage meaning its own executable (think inception, but with exes). This isn’t all that uncommon with malware. Typically the file you first download isn’t always the main exe. The “dropper” will determine your sys info and download the second stage, or the second stage will be hidden away encrypted to hide from AV’s and heuristics. <\/p>\n

The file<\/a><\/p>\n

SHA256: \t8e3602a83178039c076b74cc38d8fdf502b1a1a1a3c312b5a0700c682524ae8d
\nFile name: \tmanptca.exe
\nDetection ratio: \t35 \/ 57
\nAnalysis date: \t2015-09-16 21:18:29 UTC ( 1 week, 1 day ago ) <\/p>\n

First thing I do is load the guy up with CFF Explorer and explore…
\n\"p1\"<\/a><\/p>\n

Sample is .net, but I already knew that. The version is 2.0 (version string in the Metadata header).<\/p>\n

Since it’s a .NET binary, we can load the sample into ilspy, or reflector, or some sort of decompiler.<\/p>\n

\"p2-2\"<\/a><\/p>\n

As we can see, the sample is obfuscated. I also see a bitmap stored as a resource named ‘jucausa’. More on that image later and how it relates to our stage 3. <\/p>\n

Easiest way to defeat most obfuscation is a little utility called . Just compile, drag, and drop. <\/p>\n

\"p3\"<\/a><\/p>\n

As you can see, de4dot identified the obfuscator and automatically changed everything back to normal. Nice eh? Now let’s look at the binary again in ilspy (Reflector is a piece of shit sometimes). <\/p>\n

\"p4\"<\/a><\/p>\n

The sample has been deobfuscated, but is still a mess. What can we do? Enter MegaDumper<\/a>. Russians make the best tools. So how does this work? Well, MegaDumper allows us to dump .net binaries straight from memory. All we have to do is run the exe, suspend its main thread, then dump away.<\/p>\n

It’s easier to just record how its done here:
\n