Peeling Back the Layers of .NET Malware

This blog post analyzes an obfuscated .NET malware sample found in a startup .url that pointed to a local executable; the sample XOR-deobfuscates embedded C# code, compiles a DLL at runtime, decodes an embedded PNG resource to extract a payload, and contains capabilities to disable antivirus, steal credentials, log keystrokes, and control a webcam.