Loading malware…
ConfuserEx is an open-source .NET protector and obfuscator rather than a malware family. It is widely used to hinder reverse engineering of malicious .NET assemblies by applying control-flow obfuscation, symbol renaming, anti-tamper protections, proxy-call indirection, and constant encoding. In intrusion chains, it commonly appears as a protective layer around loaders, stealers, ransomware, RATs, and privilege-escalation tooling, including PureCrypter-wrapped loaders, PureLogs and DarkCloud delivery components, HawkEye Reborn samples, SectopRAT, and other .NET implants. ConfuserEx-protected malware is frequently observed in phishing- and malvertising-delivered campaigns targeting Windows environments across government, healthcare, education, hospitality, and regional espionage targets. Its role is defensive from the attacker’s perspective: increasing analysis cost, frustrating static decompilation, and protecting embedded payloads or staged execution logic. ConfuserEx itself should not be classified as malware; it is a legitimate software protection framework that is regularly abused in malicious operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The dropped DLL, which we will later refer to as the first stage implant, is written in C# and obfuscated using ConfuserEx.
The dropped DLL, which we will later refer to as the first stage implant, is written in C# and obfuscated using ConfuserEx.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
This script is a fully functional Python loader targeting Windows systems. It is heavily obfuscated — every string is Base64-encoded and every numeric constant is hidden behind multi-term arithmetic expressions.
To be fully undetectable, the Ranion team has consistently relied on the ConfuserEx project... It is a free and open-source obfuscator that makes malware harder to analyze by “protecting” .NET applications through symbol renaming, anti-debugging, encryption, compression, and other functions. ... MITRE ATT&CK information Defense Evasion - T1027.002: Software Packing
String Protection : C2 host, port, mutex, installation path, and other configuration strings are encrypted ... The C2 host/port cannot be extracted statically
It is further obfuscated using ConfuserEx, disguised as a Python installer
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A .NET obfuscation/protection tool used to protect the intermediate loaders that decrypt and launch PureLog Stealer in memory.
A .NET obfuscator/protector used to hinder analysis of the PureLogs .NET component.
.NET obfuscator used to protect the loader executables (e.g., control-flow flattening, opaque predicates, dead-code injection) to hinder static analysis and reverse engineering.
A publicly available .NET obfuscator used here to protect/obfuscate first-stage C# downloader/implant DLLs from analysis and signature-based detection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.