Malware Analysis - Agniane Stealer, Native Stub to .NET Unpacking

We trace API calls of a packed native file using hasherezade’s tiny_tracer and discover that it unpacks a .NET payload. Using x64dbg we unpack the .NET assembly and find it unreadable, among others due to dr4k0nia’s XOR string obfuscation. Buy me a coffee: Follow me on Twitter: Sample: tiny_tracer: PortexAnalyzerGUI: x64dbg: de4dot: dnSpy: