Reverse Engineering RexCry | Unpacking a .NET Loader That Drops StormKitty Infostealer

This video analyzes "Rex Cry," a .NET-based dropper for the Storm Kitty infostealer, demonstrating how to reverse-engineer its AES decryption logic to extract the embedded payload and configuration.

Key Takeaways:
• Rex Cry is a .NET executable with a 44/70 VirusTotal detection rate, functioning as a dropper for the Storm Kitty infostealer 0:26.
• The dropper embeds the payload at the end of its file; static analysis reveals it uses base64 encoding and a specific magic string to locate the binary data 2:15.
• The presenter uses dnSpy and Python to reverse-engineer the AES decryption, identifying the hardcoded password "1234" used to derive the encryption key 13:50.
• Once decrypted, the Storm Kitty payload reveals capabilities including clipboard manipulation (clipper), keylogging, and webcam activation 17:42.
• The malware targets cryptocurrency wallets by replacing copied Bitcoin addresses with attacker-controlled addresses, with evidence of funds being transferred to external wallets 25:20.
• Unique features include targeting pornographic websites to capture screenshots for potential blackmail or future ransom 29:12.

Rex Cry acts as a straightforward vector for deploying Storm Kitty, relying on predictable encryption keys that simplify analysis while enabling extensive data theft.

Sources:

• 0:26 Introduction of Rex Cry malware and VirusTotal stats
• 2:15 Static analysis of the embedded payload structure
• 13:50 Reverse-engineering the AES decryption key derivation
• [17:42](