{"id":55694,"date":"2024-03-27T14:31:42","date_gmt":"2024-03-27T14:31:42","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35707\/Analyse-Hunt-And-Classify-Malware-Using-.NET-Metadata.html"},"modified":"2024-03-27T14:31:42","modified_gmt":"2024-03-27T14:31:42","slug":"analyse-hunt-and-classify-malware-using-net-metadata","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/analyse-hunt-and-classify-malware-using-net-metadata\/","title":{"rendered":"Analyse, Hunt, And Classify Malware Using .NET Metadata"},"content":{"rendered":"

Introduction<\/span><\/span><\/h2>\n

<\/p>\n

Earlier last week, I ran into a sample that turned out to be PureCrypter<\/a>, a loader and obfuscator for all different kinds of malware such as Agent Tesla and RedLine. <\/span><\/p>\n

Upon further investigation, I developed Yara rules for the various stages, which can be found here (excluding the final payload):<\/span><\/p>\n

With that out of the way, all of this reminded me of the fact that we can also write Yara rules for unique identifiers specific to malware written in .NET, or any other .NET assemblies for that matter.<\/span><\/p>\n

A bit of history<\/span><\/span><\/p>\n

This isn\u2019t my first encounter with analysing .NET malware at scale: several years ago, I co-authored a presentation<\/a> with Santiago<\/a> on hunting SteamStealer malware, which was surging exponentially at the time (the malware intended to steal your Steam inventory items and\/or your account). A huge thanks goes to Brian Wallace who had developed a tool at the time called GetNetGUIDs<\/a> with which it<\/span> was trivial to extract all the GUID types and start clustering to identify patterns: basically, which of the malware samples are likely authored by the same person or belong to the same attack campaign.<\/span><\/p>\n

.NET assemblies or binaries often contain all sorts of metadata, such as the internal assembly name and GUIDs, specifically; the MVID and TYPELIB.<\/span><\/p>\n