Loading malware…
ConfuserEx is an open-source protector and obfuscator for .NET assemblies. It is used to hinder static analysis and reverse engineering through control-flow obfuscation, symbol renaming, anti-tamper protections, proxy-call indirection, and constant encoding. Threat actors commonly apply ConfuserEx to Windows .NET loaders, remote-access trojans, stealers, ransomware, and first-stage implants to impede decompilation and conceal payload-loading logic. It has been observed in malware operations involving PureCrypter and PureLogs, DarkCloud Stealer, SectopRAT, Hidden Tear-derived ransomware, and activity associated with UAC-0057/UNC1151. ConfuserEx is a defensive-evasion utility rather than a malware family or a payload itself.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The dropped DLL, which we will later refer to as the first stage implant, is written in C# and obfuscated using ConfuserEx.
The dropped DLL, which we will later refer to as the first stage implant, is written in C# and obfuscated using ConfuserEx.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.
The operators are using open-source .NET obfuscators such as Obfuscar, NETShield and ConfuserEx to increase the evasiveness of their crypter stub.
To be fully undetectable, the Ranion team has consistently relied on the ConfuserEx project... It is a free and open-source obfuscator that makes malware harder to analyze by “protecting” .NET applications through symbol renaming, anti-debugging, encryption, compression, and other functions. ... MITRE ATT&CK information Defense Evasion - T1027.002: Software Packing
String Protection : C2 host, port, mutex, installation path, and other configuration strings are encrypted ... The C2 host/port cannot be extracted statically
It is further obfuscated using ConfuserEx, disguised as a Python installer
MITRE ATT&CK FRAMEWORK ... Stealth T1140 Deobfuscate/Decode Files Runtime decoding of protected assemblies
Tax_Assessment.exe was observed loading libsvcs.dll through Assembly.LoadFrom(). After successfully loading the assembly, the executable uses reflection to resolve the client.DllEntry class and invoke the Run method.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.