Powershell and DnSpy tricks in .NET reversing - AgentTesla [Part1]

This video covers reversing path to the final payload of AgentTesla.
This video was created for educational purposes.
Github GUIDE (All scripts and sample to download) - Link:
github.com/Dump-GUY/Malware-a...
Content:
This part covers extraction of all stages during reversing original sample and obtaining final payload. Most of the video is about advanced usage of DnSpy like in memory patching obfuscated modules for deobfuscated which got loaded runtime as next stages. I will provide simple way how one can benefit from views like Call Stack, Memory View, Modules View, Locals etc.. In memory (during runtime) replacing obfuscated next stage modules for deobfuscated ones is one of the trick which will be shown. Many tricks how one can interact with .NET assembly via Powershell will be introduced (Loading .NET assembly, Invoking methods (even private), patching methods, getting assembly field values etc..). The biggest advantage all of this is that we will have all execution process under control.

[@Ajaykumar-wk2fd]

Excellent piece of work !!! 👏

[@x00tox01]

Great Work!!! Very Detailed and Learned a Alot!!!
Please keep posting such video and knowledge sharing.

[@DuMpGuYTrIcKsTeR]

Thank you. Glad to hear it☺

[@chaitanyaghorpade830]

Really helpful tricks 👍🏽

[@fikrahack]

The best

[@lingaiahthotla]

HI, Can you help to reverse .net dll

[@invincibleHunter]

when i put dll in dnspy it loads as PE

[@leorogersreddy7199]

password for extraction files

[@DuMpGuYTrIcKsTeR]

Should be "infected" without quotations marks. It´s written on github. :)

[@mxG0-sm1jt]

Hi! Thanks for this awesome work. When I reproduce this project by myself, I meet a problem that I don't know how to resolve it. The question is the skill u introduce in this video that is something about how to invoke method defined as "private" via specifying "System.Reflection.BindingFlags". So I want to use this way to decode the stage1 base on the no patched file, But When I use "New-Object" to create a new target object, an error about the number of parameters is incorrect has occurred! So I check the "VandelaySplashScreen" parameter's number, I found that it is indeed 0 parameters in dnspy. So I don't know how to resolve it, can u help me!!!
The script is as follows:
$assembly = [System.Reflection.Assembly]::LoadFile("C:\Users\g0mx\Desktop\original_sample.bin")
$MapX = $assembly.GetType("VandelayHealthBenefits.VDObjects").GetField('MapX').GetValue($null)
$VandelaySplashScreen = $assembly.GetType("VandelayHealthBenefits.VandelaySplashScreen")
$my_VandelaySplashScreen = New-Object $VandelaySplashScreen
$deobfuscatedString_base64 = ($VandelaySplashScreen.GetMethod("GameLoop0",[System.Reflection.BindingFlags]::NonPublic -bor [System.Reflection.BindingFlags]::Instance)).invoke($my_VandelaySplashScreen,$MapX)
$bytes = ($VandelaySplashScreen.GetMethod("A9283",[System.Reflection.BindingFlags]::NonPublic -bor [System.Reflection.BindingFlags]::Instance)).invoke($my_VandelaySplashScreen,$deobfuscatedString_base64)
$bytes[0..250] | Format-Hex
I know this project has been over a long time, and I would appreciate it if you had time to help me resolve this problem!