Another common technique used by .NET samples is encrypting the malware strings. Encrypting strings hides these strings from signature-based tools, as well as from less experienced malware analysts. Working with encrypted strings requires finding the decryption function and setting a breakpoint on each of its calls, as you can see in the following screenshot:
Figure 10: Samsam ransomware encrypted strings getting decrypted in memory
Sometimes, there are hard to reach encrypted strings, so you may not see them decrypted in the normal execution of the malware. For example, because the C&C is down, or maybe there are additional C&C addresses that won't get decrypted if the first C&C is working. In these cases, you can do any of the following:
- You can use de4dot to decrypt the encrypted strings by giving it the method ID. You can find the method ID by checking the Methods table in the #~ stream, as you can see in the following screenshot...
