I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection

file inside DnsPy

It would be great if someone could help me identify this obfuscation/packing/protection, as I am really not proficient with .NET obfuscation and unpacking. I really appreciate any help you can provide.


Reverse engineering rookie.

1 Answer 1


Using DetectItEasy you can obtain the Packer used:

"Protector: Crypto Obfuscator For .Net (5.X)"

enter image description here

de4dot supports this packer, so if you use it de4dot.exe <filename> you will obtain the unpacked file

enter image description here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.