Skip to main content
CPEBuddy
Reverse Engineering an Unknown NET Malware | Infostealer, Spreader & r77 Rootkit

Reverse Engineering an Unknown NET Malware | Infostealer, Spreader & r77 Rootkit

Source: YouTube · Malware Research Diary · published Aug 26, 2026 · 49:21

Malware Analysis
No ratings yet Log in to rate
Transcript Available
Description

BLUF: This video analyzes an early-development .NET dropper that deploys a client-server RAT with process injection, rootkit capabilities, and encrypted C2 communication 0:28.

Key Takeaways:
• The .NET dropper contains four embedded executables and extracts holy check.exe plus a server component to a startup folder 2:42.
• The client's config reveals C2 details (TCP port 22678, group ID) and capabilities like screenshot capture and camera access 8:51.
• SHA256-based string encryption is buggy or incomplete, suggesting the sample is still in development 13:32.
• Anti-VM checks include CPU core count verification and DLL lookups 16:10.
• A secondary component (7786.dll) acts as a rootkit, monitoring processes and redirecting code via detours 38:11.
• Despite flawed encryption, the malware shows sophisticated capabilities like injection and rootkit behavior 49:00.

This work-in-progress RAT highlights the value of examining embedded resources in .NET malware; further server-side analysis could reveal operator infrastructure.

Sources:

  • 0:28 Introduction to the .NET loader binary
  • 2:42 Embedded executable extraction
  • 8:51 C2 config and client capabilities
  • 13:32 Flawed SHA256 encryption analysis
  • 16:10 Anti-VM techniques
  • 38:11 Rootkit driver analysis
  • 49:00 Final conclusions

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Hello everyone. Welcome back to another session in analyzing malares. It's been a while. So, uh let's take a look today. Um I download a few um sample today. And um let's take a look and see what each of these are. Um haven't take a look yet. So, it's going brand new. Um let's go with the first one is um advanced boot loader. um binary. So let's do strings. This file is um based is seem to be a net um malware. Um here's a interesting um um strings. So it's a debug pdb. here source is uh called to rat server um server pdb and just look up on virus total and see if there's anything interesting. So my goal usually in analyzing this or just providing a a quick overview of what it does um if it really interesting then I would go a little bit deeper in analyzing you know the reverse engineering …