u/jershmagershin r/ReverseEngineering • Recommends
Beginner Malware Analysis: DCRat with dnSpy
0:00 / 0:00
Beginner Malware Analysis: DCRat with dnSpy (Stream 03/06/2025)
Invoke RE
4.6K subscribers • 2 videos on Hallway
- Recommended by 1 person: 1 in engineering communities.
- Linked in the descriptionInvoke-RE/stream-notes
Beginner. No background in the topic needed.
2.5K views1 year ago1 recommendation
SecurityReverse engineeringPython
A walkthrough of analyzing a DCRat .NET assembly using dnSpy and writing Python scripts to decrypt its configuration.
In this stream we analyzed a DCRat .NET assembly with dnSpy, wrote Python automation to decrypt its configuration items, found additional samples with unpac.me and Yara, then tested our decryption script against additional samples. Learn how to reverse engineer malware: training.invokere.com/ Merch: shop.invokere.com Notes: github.com/Invoke-RE/stream-notes/tree/main/dcrat Twitch: twitch.tv/InvokeReversing Twitter: twitter.com/InvokeReversing BlueSky: bsky.app/profile/invokereversing.bsky.social/ Mastodon: infosec.exchange/@invokereversing Introduction Global Setting Decryption Anti-Analysis Mutex Creation Process Killing Thread Privilege and BSOD Protection Persistence Clear Settings AMSI Bypass Command and Control Camera Functionality Hardware ID Generation Information Collection Decrypting Configuration Items with Cyberchef Decrypting Configuration with Python dncil Python Decryption Working with dncil Testing Against Other Samples Writing Yara to Find More Samples Testing with AssemblyLineWhy it's here
1 person recommends thisWhat people say. Recommended as a practical, beginner-friendly guide to malware analysis and configuration decryption.