Alexandre Borges - .NET Malware Threats: Internals And Reversing
Deep-dives into .NET CLR internals to equip analysts with techniques for reversing obfuscated .NET malware families.
Summary
.NET Malware Internals
Alexandre Borges, malware researcher, delivers an in-depth technical session on analyzing modern .NET-based malware, covering CLR internals, obfuscation techniques, and dynamic analysis strategies.
CLR Architecture Fundamentals
The talk begins with the Common Language Runtime's execution model — MSIL compilation, JIT compilation, AppDomain isolation, and the managed heap — providing the foundational context for understanding how malware abuses these mechanisms.
Obfuscation Techniques
Borges catalogs common .NET obfuscation strategies: string encryption, control flow flattening, method name mangling, and anti-decompilation tricks targeting dnSpy and ILSpy. He demonstrates automated de-obfuscation using de4dot and custom MSIL patching.
Dynamic Analysis with CLR Profiler
Using the CLR Profiling API, analysts can hook JIT compilation events to capture de-obfuscated MSIL at runtime without static unpacking. Borges demonstrates this against real AgentTesla and AsyncRAT samples.
Related talks
Main Stage·39 min
Agostino Panico
Presents a dynamic analysis framework for automatically unpacking and deobfuscating nested virtual-machine-based software protectors used in advanced malware.
Main Stage·21 min
Patrick Wardle
Patrick Wardle presents specialized reverse engineering techniques and tooling to automatically extract obfuscated AppleScript and shell payloads from macOS malware.
Main Stage·42 min
Laurie Kirk
Laurie Kirk unveils runtime manipulation techniques in native C++ via JNI to alter Android execution flow, defeating emulators and decompilers.