A beginner-friendly, static-only walkthrough of a .NET loader that treats GitHub as its command-and-control channel.
Category: Loader · Difficulty: Easy · Tools: Detect It Easy (DIE), de4dot, dnSpy, Python
One note before we start: everything below is static analysis. I never executed the sample, and I’d gently suggest you never run unknown files on your daily machine either. Static analysis gets you surprisingly far with .NET samples — everything is sitting right there in the binary, you just have to make it readable again.
The challenge hands you one file called challenge. No extension, no instructions, thirty questions to answer. Here’s what the file says for itself:
challenge64cdbac35641e956372f315088d9d6d89cebe9916894ef24c359b699fba29f24A loader, in malware terms, is a small program whose entire job is to prepare the ground and bring in a bigger second-stage payload. This one reports the machine it lands on to its operator, picks up instructions, and decrypts and runs an extra .NET module from disk. The twist that makes it fun: all of that communication goes through GitHub, a service nobody blocks, because half the internet depends on it.
Our goal is to make the code readable enough to see all of this clearly, and to pick up the answers to the challenge questions along the way.
I like starting with DIE because it settles two questions early: what exactly is this file, and is it going to fight back while I work on it?
For this sample the answers were “.NET DLL” and “yes, a little”:
Detect It Easy: PE32 .NET DLL, MSIL/C#, protected with Obfuscar 1.0
DIE reads it as PE32, MSIL/C#, built against .NET Framework 4.5.2 on CLR v4.0.30319 — and flags one line in red: Protector: Obfuscar(1.0). That answers the “how is it obfuscated” question in one word: Obfuscar.
Obfuscar is an open-source obfuscator for .NET. It renames every class and method into meaningless junk and reshuffles code so nothing reads naturally. Compared to commercial protectors it’s mild, and de4dot makes short work of it:
de4dot.exe challenge