reverse-engineering-dotnet-malware-with-dnspy

name	reverse-engineering-dotnet-malware-with-dnspy
description	Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","dotnet","reverse-engineering","dnSpy","decompilation"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Reverse Engineering .NET Malware with dnSpy

When to Use

• A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation
• Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)
• Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators
• Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies
• Debugging .NET malware at runtime to observe decryption routines and dynamic behavior

Do not use for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis.

Detection Gaps & Validation

• Analyzing before de4dot is the #1 wasted effort. ConfuserEx control-flow flattening and string encryption turn dnSpy output into unreadable switch-state machines. Run de4dot (with the right -p profile, or let it auto-detect) first; if de4dot can't fully clean a custom/forked ConfuserEx, fall back to dynamic string capture (Step 5) rather than reading encrypted IL.
• The config is usually not a hardcoded string. AgentTesla/AsyncRAT/RedLine store C2 in encrypted .NET resources or Base64+AES blobs decrypted at runtime. A clean string/IL grep is a false negative — set a breakpoint after the decrypt routine returns and read the plaintext from Locals, or dump it from the Immediate window.
• Anti-debug will derail dnSpy. Samples call Debugger.IsAttached, CheckRemoteDebuggerPresent, timing checks, or Anti-tamper that corrupts method bodies under a debugger. Patch the check to return false in dnSpy, or use de4dot's anti-tamper removal, before stepping.
• Multi-stage loading hides the real payload. The initial assembly often Assembly.Loads a second stage from a resource in memory (fileless). If the entry point looks empty, find the Load/Invoke call and dump the loaded bytes for separate analysis.
• Confirm cross-tool: validate decompilation against ILSpy/dotPeek (decompilers disagree on obfuscated code) and capture C2 dynamically with network isolation — a stealer will exfiltrate the moment you hit F5.
• Benign-lookalike FPs: commercial .NET apps also use ConfuserEx/SmartAssembly and load assemblies from resources; obfuscation alone is not malicious. Confirm via the decrypted C2/exfil config.

Prerequisites

• dnSpy or dnSpyEx installed (https://github.com/dnSpyEx/dnSpy - community maintained fork)