Unable to unpack heavly obfuscated malware

Question

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted.

I tried all possible tools that I found online, when that failed I tried to do so manually using some tutorials I found online, I always end up destroying the executable in the first stage of the unpacking. I'm using dnspy for this sample. each time I attempt to locate the anti-tamper module, it ends up being the incorrect one and i end up destroying the executable..

Then I tried to debug it and check for memory dumps on x64(32 bit) debugger, I found some anti debugging mechanisms but I am still missing something because the program just keeps running junk code until i detach from it and it crashes, dumping it when its already loaded into memory also dumps junk code.

What am I missing here? Does anyone have experience with unpacking the confuserex packer? Can you guys link me to some information I'm missing? or maybe explain how the ConfuserEx works?

I would appreciate help in understanding how to unpack it. I'll provide the sample here:

[WARNING THIS IS A LIVE MALWARE SAMPLE]
eagleepicsocks(dot)com/jk/jkeq.exe
[WARNING THIS IS A LIVE MALWARE SAMPLE]

Answer 1

ConfuserEx unpacks your executable at runtime and then gives control to it. After the ConfuserEx loader finishes its job you can dump the memory and the assembly.

In order to avoid detection, you can restort to SysInternals Process Explorer or ProcDump to dump the live process after the loader has finished unpacking. This avoids early interference with the loader and simplifies your dump if no other measures are implemented in the protected program.

You can find an unpacker, this for example, ConfuserEx-Unpacker should do the job. However, the more interesting part is do it by hand: this well-written blog shows how to do that in a real case.