Getting Started with dnSpyEx - Unraveling a .NET Formbook Dropper

In this video, I'll show you the basics of the dnSpyEx interface and discuss techniques for performing effective static and dynamic analysis. We'll use a recent Formbook malware sample for this demo and unravel several stages of obfuscation to find the primary payload. By the end of this video, you'll be able to decompile .NET binaries, analyze the code using the dnSpyEx interface, and learn how to use the basics of the debugger to trace through the program.
Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 www.pluralsigh...
🌶️ TH-cam 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 / joshstroschein
🌎 Follow me 👉🏻 / jstrosch , / joshstroschein
⚙️ Tinker with me on Github 👉🏻 github.com/jst...
Sample SHA256: 1e76071fd87642e4070b75b2f542d65d304dcbb8482e795610bd53b34c54bcb8

[@linuxstudent5158]

Its a shame this only gets 102 like. This is REAL stuff. Anyway, Thank you Dr, I truly appreciate what you told me in this video. You've earned a subscriber.

[@jstrosch]

Thank you for the kind words and support 🙏

[@MartinBAYARD]

Thanks for the video/tutorial, very helpful as usual !
I noticed that the PE stored in the array variable (line 61, discussed at 23:00) is the final stage one (the one used in process hollowing by the 2nd assembly).
If we want to save the second assembly (BUMBUM.dll) it has to be done at line 99 of the code.
Hope it helps !

[@jstrosch]

Thanks for the tip - very helpful!

[@ghazialkofahi6653]

thanks dr your videos really useful for me i appreciate your efforts.

[@jstrosch]

It's my pleasure!

[@huongtuoitho4096]

Need your help with my dll file. Please

[@jstrosch]

Well, that could go in many different directions. Is there something in particular you are looking for? If not, I'd suggest starting with one of my videos covering PEStudio - that will give you some basic triage insights.

[@christiangualteros36]

Thank you

[@jstrosch]

You're welcome

[@MartinBAYARD]

Would have been nice to add the SHA256 of your sample in the video description 🥲

[@jstrosch]

oh I forgot! Thanks for the reminder, I added the hash to the description, its:
1e76071fd87642e4070b75b2f542d65d304dcbb8482e795610bd53b34c54bcb8
You can find the sample on Malware Bazaar for download. Thanks again for reaching out!

[@MartinBAYARD]

Thanks @jstrosch !